Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add pixijs/pixijs-skills --skill pixijs-html-sourcegit clone --depth 1 https://github.com/pixijs/pixijs-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pixijs/pixijs-skills/pixijs-html-source)<a href="https://agentmods.dev/skills/pixijs/pixijs-skills/pixijs-html-source"><img src="https://agentmods.dev/badge/skills/pixijs/pixijs-skills/pixijs-html-source/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pixijs/pixijs-skills/pixijs-html-source"><img src="https://agentmods.dev/badge/skills/pixijs/pixijs-skills/pixijs-html-source.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket pass
- Snyk pass
- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Prompt Injection · line 46 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
- medium Prompt Injection · line 56 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00216 | $0.02840 |
| Opus 5 | $0.00108 | $0.01420 |
| Sonnet 5 | $0.00043 | $0.00568 |
| Haiku 4.5 | $0.00022 | $0.00284 |
Grade A, and why
pixijs-html-source scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 228 lines — stays where its author put it; the contents beside it link to each section on GitHub.
HTMLSource and ElementImageSource turn a DOM element into a TextureSource you can use anywhere a normal texture works: on a Sprite, as a Texture frame, or mapped onto a Mesh. HTMLSource mirrors a live element's pixels into the GPU (the element stays editable and clickable in the browser); ElementImageSource wraps an immutable snapshot that never repaints. Both require a side-effect import 'pixi.js/html-source' to register their extensions.
These sources rely on the experimental HTML-in-Canvas browser proposal and are marked EXPERIMENTAL in PixiJS v8. The browser API must be enabled or the texture uploader throws on first render; feature-detect with
canvas.requestPaintbefore relying on it. The API may change between minor releases.
Assumes familiarity with pixijs-scene-sprite and textures. These are texture sources, not display objects: wrap them in a Sprite (or Texture/Mesh) to put them on screen. Not available in Web Workers; a worker has no DOM to capture.
Quick Start
import "pixi.js/html-source";
import { Application, Sprite } from "pixi.js";
import { HTMLSource } from "pixi.js/html-source";
const app = new Application();
await app.init({ resizeTo: window });
document.body.appendChild(app.canvas);
// The element must be a direct child of the Pixi canvas.
const form = document.createElement("form");
form.innerHTML = '<input value="still editable" />';
app.canvas.appendChild(form);
// Render the live form as a sprite. It stays interactive in the browser.
const source = new HTMLSource({ resource: form });
const sprite = Sprite.from(source);
sprite.anchor.set(0.5);
sprite.position.set(app.screen.width / 2, app.screen.height / 2);
app.stage.addChild(sprite);
Related skills: pixijs-scene-sprite (display the texture), pixijs-scene-mesh (map onto geometry, PerspectiveMesh), pixijs-scene-dom-container (the opposite: overlay HTML above the canvas, outside the GPU pipeline), pixijs-assets (texture sources vs the loader/cache), pixijs-environments (no DOM in Web Workers).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 228 lines · 216 tokens per session scan A 18e44b0d40a7
pixijs-html-source is a skill published in the GitHub repository pixijs/pixijs-skills (329 stars, last pushed 3mo ago), licensed MIT. It adds 216 tokens to every session and 2,840 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
worker-visualizer
A real-time data/particle/simulation visualizer whose heavy compute runs in a Web Worker (off the main thread), optionally sharing memory with the UI via SharedArrayBuffer, and renders to a canvas at 60fps. Produced as a single self-contained index.html. Use when the brief asks for a "web worker", "simulation"…
react-three-fiber
React Three Fiber 3D renderer for json-render. Use when working with @json-render/react-three-fiber, building 3D scenes from JSON specs, rendering meshes/lights/models/environments, or integrating Three.js with json-render catalogs.
vgpu
Build, debug, test, and optimize WebGPU projects using vgpu, its CLI, or @vgpu packages. Use for vgpu API questions, WGSL workflows, browser or Node rendering, integrations, testing, and performance work.
matterjs
Use when implementing 2D physics interactions with Matter.js, including Engine/World setup, Render/Runner configuration, adding bodies and constraints, and scroll/interaction-friendly canvas scenes.
html-to-ugui
A pipeline for turning HTML interface prototypes into Unity UGUI Prefabs, which are reusable Unity interface objects. It uses browser-rendered layout data to preserve positions, images, text, controls, and device-adaptation intentions.
threejs-game-director
Entrypoint for building, upgrading, and finishing Three.js browser games. Routes work across the sibling threejs- skills for gameplay, graphics, UI, 3D/image/audio asset generation, debugging, and release. Use for build-a-game, upgrade, polish, premium, AAA, high-fidelity, showcase, from-scratch, endless runner…