Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/tale-project/tale/visual-aspect-analyzernpx skills add tale-project/tale --skill visual-aspect-analyzergit clone --depth 1 https://github.com/tale-project/taleWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00190 | $0.03957 |
| Opus 5 | $0.00095 | $0.01978 |
| Sonnet 5 | $0.00038 | $0.00791 |
| Haiku 4.5 | $0.00019 | $0.00396 |
Grade A, and why
visual-aspect-analyzer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 221 lines — stays where its author put it; the contents beside it link to each section on GitHub.
visual-aspect-analyzer
When you have finished a UI change, run this as the final review step — once,
at the end, not after every individual edit. It is the visual-regression gate: the
change is not done until it reports score: 100
(Test a UI change).
Drive a real browser over a session and report, per auto-detected element, what actually changed on screen. You don't pick the elements — the instrument finds the page's relevant ones itself (Auto-detection). Impact is temporal — true if it held in any frame — so an element that only starts painting or moving mid-session is still caught.
Boundaries. It auto-scrolls but never clicks, types, or logs in, so defects behind an
interaction are caught only via the embed interact hook. It sees the
main document only — closed shadow roots and cross-origin iframes aren't pierced.
Run it
bun src/analyze-cli.ts <url> # run from the skill directory
In the Tale sandbox this is pre-installed — the bundle, its pngjs dep, the
playwright package (shared with the agent's browser tooling), and Chromium are all baked
into the image, so there is no install step. (Working on the skill locally instead?
Install the browser tooling once first: bun add -d playwright && bunx playwright install chromium.)
Paths below are relative to the skill directory. Needs Bun (bun.sh) —
no npm/node fallback. The run is headless and self-driving: it loads the page hidden,
auto-scrolls the whole session, then exits on its own (seconds for a light page) — nothing
waits on you. Any reachable URL works, including a local dev server (http://localhost:3000)
— start your server first; the tool drives a browser, it doesn't launch your app.
- No build step — Bun runs the TypeScript directly and bundles the in-page instrument in memory.
- Always on — pixel capture (dithering + the paint check) and auto-scroll (lazy content + CLS), so a bare run never silently misses a defect.
- stdout is pure JSON (the compact report); the health summary always prints to stderr.
bun src/analyze-cli.ts <url> > report.jsonsaves the report while the summary still shows in your terminal. - One flag,
--full(the faithful Report). It fixes the session knobs (keyframes4,settleMs500 → a ~2 s sample window); to tune sampling depth/window, dithering sensitivity (pixelThreshold), or to log in before sampling, use the embed path. - Offline — re-analyze a saved recording with no browser:
bun src/cli.ts <recording.json>.
What ships with it
60 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- examples/run.md 4.2 KB
- examples/sample-recording.json 4.3 KB
- examples/sample-report.json 1.3 KB
- package.json 616 B
- README.md 6.9 KB
- src/accname.test.ts 15 KB runs code
- src/accname.ts 12 KB runs code
- src/analyze-cli.test.ts 22 KB runs code
- src/analyze-cli.ts 5.8 KB runs code
- src/analyzer.test.ts 9.8 KB runs code
- src/anchors.test.ts 15 KB runs code
- src/anchors.ts 8.3 KB runs code
- src/annotate.test.ts 3.0 KB runs code
- src/annotate.ts 2.3 KB runs code
- src/bundle.test.ts 1.5 KB runs code
- src/bundle.ts 1.5 KB runs code
- src/cli.test.ts 3.0 KB runs code
- src/cli.ts 1.2 KB runs code
- src/compact.test.ts 17 KB runs code
- src/compact.ts 10 KB runs code
- src/defects/analyze.test.ts 15 KB runs code
- src/defects/analyze.ts 12 KB runs code
- src/defects/dithering.test.ts 6.4 KB runs code
- src/defects/dithering.ts 3.8 KB runs code
- src/defects/easing.test.ts 7.7 KB runs code
- src/defects/easing.ts 7.4 KB runs code
- src/defects/flicker.test.ts 2.1 KB runs code
- src/defects/flicker.ts 2.2 KB runs code
- src/defects/jank.test.ts 2.8 KB runs code
- src/defects/jank.ts 3.0 KB runs code
- src/defects/transition-defects.md 4.4 KB
- src/defects/transitions.test.ts 9.5 KB runs code
- src/defects/transitions.ts 9.0 KB runs code
- src/driver.test.ts 16 KB runs code
- src/driver.ts 7.7 KB runs code
- src/e2e.ts 7.3 KB runs code
- src/examples.test.ts 1.0 KB runs code
- src/geometry.test.ts 3.3 KB runs code
- src/geometry.ts 3.3 KB runs code
- src/impact-detection.md 6.5 KB
- src/impact.test.ts 13 KB runs code
- src/impact.ts 10 KB runs code
- src/instrument-global.ts 945 B runs code
- src/instrument-live.test.ts 21 KB runs code
- src/instrument.test.ts 17 KB runs code
- src/instrument.ts 47 KB runs code
- src/listeners.test.ts 5.6 KB runs code
- src/listeners.ts 4.4 KB runs code
- src/pixels.test.ts 3.2 KB runs code
- src/pixels.ts 2.5 KB runs code
- src/recording.test.ts 6.5 KB runs code
- src/recording.ts 8.5 KB runs code
- src/report.test.ts 7.4 KB runs code
- src/report.ts 4.1 KB runs code
- src/select.test.ts 13 KB runs code
- src/select.ts 18 KB runs code
- src/summarize.test.ts 5.1 KB runs code
- src/summarize.ts 6.2 KB runs code
- src/test-fixtures.ts 2.8 KB runs code
- src/types.ts 9.8 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 221 lines · 190 tokens per session scan A 6f502957dc77
visual-aspect-analyzer is a skill published in the GitHub repository tale-project/tale (23 stars, last pushed 2d ago), licensed MIT. It adds 190 tokens to every session and 3,957 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
audit-event
Use when adding or changing an audit event, the audit log schema, SIEM export, or anything writing to auditevents. Also use when adding a code path that grants or denies access, since denials are events. Triggers on "audit", "audit log", "auditevents", "SIEM", "journal", "access log", "who read what".
db-migration
Use when changing the PostgreSQL schema, adding a migration under packages/core/migrations, or touching row-level security, the grants table, tombstones, or the audit table. Triggers on "migration", "schema", "DDL", "RLS", "row level security", "ALTER TABLE", "new column", "index" in a database context.
mcp-tool
Use when adding or changing an MCP tool, the MCP transport, or MCP authorization in packages/mcp — tool schemas, tools/list, the Streamable HTTP endpoint, STDIO mode, OAuth, CIMD, EMA, or ID-JAG. Triggers on "MCP tool", "tools/list", "Streamable HTTP", "Mcp-Method", "CIMD", "DCR", "EMA", "ID-JAG", "resource server"…
open-core-boundary
Use when deciding whether a feature belongs in this open-source repository or in the private nacre-enterprise one, when adding an extension point, or when a change touches multi-tenancy, SSO, SCIM, document-level deny rules, EMA/ID-JAG, the audit log, the global admin, or quotas. Triggers on "enterprise"…
authz-change
Use when changing anything under packages/core/authz, the grants table, the effective-principals cache, or the vector pre-filter — the permission resolver, deny handling, scope inheritance, ACL tags, or the T1-T25 suite. Also use when a change elsewhere could affect who can see what, such as touching search filters…
config-var
Use when adding, renaming, or removing an environment variable, changing startup configuration validation, adding a Compose profile or service, or adding a Prometheus metric. Triggers on "environment variable", "NACRE", "config", "docker compose", "profile", "metrics", "healthcheck", "readiness".