Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/SethGammon/Citadelnpx agentmods add skills/sethgammon/citadel/live-previewWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sethgammon/citadel/live-preview)<a href="https://agentmods.dev/skills/sethgammon/citadel/live-preview"><img src="https://agentmods.dev/badge/skills/sethgammon/citadel/live-preview/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sethgammon/citadel/live-preview"><img src="https://agentmods.dev/badge/skills/sethgammon/citadel/live-preview.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 23 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 59 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 64 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00040 | $0.01558 |
| Opus 5.5 | $0.00016 | $0.00623 |
| Sonnet 5.5 | $0.00008 | $0.00312 |
| Haiku 4.5 | $0.00004 | $0.00156 |
Grade A, and why
live-preview scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 166 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/live-preview — Build-Verify-Fix Loop
Prerequisites
This skill requires a screenshot tool. Supported:
- Playwright (recommended):
npx playwright screenshot [url] [output.png] - Puppeteer: via a small script
- Any tool that takes a URL and produces a screenshot
If no screenshot tool is available, this skill will tell you what to install and exit.
When to Use
- Any time .tsx, .jsx, .vue, .svelte, or .html files are modified
- After component creation or replacement
- During visual redesign campaigns
- When Archon or Marshal delegate UI work
Protocol
Step 1: DETECT
Determine what needs visual verification:
- Check which files were modified in the current session/phase
- Filter to view-layer files (.tsx, .jsx, .vue, .svelte, .html, .css)
- If no view-layer files found: exit early with message "No view-layer files modified. Nothing to preview." Skip Steps 2-5. This is expected for non-UI repos (CLI tools, libraries, agent harnesses).
- Map each modified file to a route or URL where it renders:
- If the project has a route manifest or sitemap, use it
- If the project has a dev server, identify which routes render the modified components
- If you can't determine the route, ask the user
Step 2: CAPTURE
For each route/URL that needs verification:
- Ensure the dev server is running (start it if not)
- Take a screenshot:
npx playwright screenshot http://localhost:{port}/{route} .planning/screenshots/{route-slug}.png --full-page - If Playwright isn't available, try:
# Check for playwright npx playwright --version 2>/dev/null # If not found, inform the user: # "live-preview needs Playwright for screenshots. Install with: npm i -D playwright"
Step 3: VERIFY
For each screenshot:
- Read the screenshot (vision). Check:
- Does the component render? (not blank, not invisible)
- Does it show real data or placeholder/empty states?
- Are there obvious layout breaks (overlapping elements, overflow, missing sections)?
- Does it match the intended design direction?
- Record the result:
- PASS: renders correctly, matches expectations
- FAIL: describe what's wrong
- BLANK: nothing rendered (critical failure)
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 166 lines · 40 tokens per session scan A baed4aabf828
live-preview is a skill published in the GitHub repository SethGammon/Citadel (925 stars, last pushed 2d ago), licensed MIT. It adds 40 tokens to every session and 1,558 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
browser-check
Drive a real browser and come back with a MEASUREMENT rather than an impression - console errors and >=400 responses as counts, computed styles as JSON when appearance is disputed. Use when work touches UI, when a review must verify one, or when fidelity-gate asks for its measurement.
test-runner
Use this skill when orchestrating agentic end-to-end tests. Resolves target + profile, dispatches the right driver(s) (playwright for web today, peekaboo for macOS (issue #381)), invokes the ux-evaluator agent (opus, read-only) against driver artifacts, reconciles findings with the open issue tracker via…
ux-grill
Use when a running web app's UX has to be audited reproducibly rather than by feel — a deterministic mechanical pass over routes and viewports (axe, target size, horizontal overflow, page title, scripted journeys) followed by a screenshot-grounded interrogation of the operator, journey by journey, with two persona…
peekaboo-driver
Use this skill when driving native-UI AX-tree snapshots and screenshots via steipete/peekaboo (MIT, macOS-only). Dispatched by skills/test-runner/ to capture native-UI AX-tree snapshots + screenshots on macOS 15+ targets, and exits with deterministic JSON output the orchestrator can parse.
playwright-driver
Use this skill when executing web tests via the canonical playwright npm package (Microsoft, Apache-2.0). Dispatched by skills/test-runner/ to execute web tests against a target, captures token-frugal AX-tree snapshots + screenshots + console output under .orchestrator/metrics/test-runs/ /, and exits with…
ios-device-qa
Use when the user runs /ios-device-qa to drive a real iPhone over USB through a debug-bridge daemon and return a device QA report with verified interactions. Do not use for remote, credential, publish, deploy, or irreversible changes.