Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/thurbeen/thurbox/thurbox-testingnpx skills add Thurbeen/thurbox --skill thurbox-testinggit clone --depth 1 https://github.com/Thurbeen/thurboxWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00111 | $0.01318 |
| Opus 5 | $0.00056 | $0.00659 |
| Sonnet 5 | $0.00022 | $0.00264 |
| Haiku 4.5 | $0.00011 | $0.00132 |
Grade A, and why
thurbox-testing scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 85 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Testing thurbox
Working reference extracted from CLAUDE.md, which indexes it. The rationale behind these decisions is owned by the docs under docs/; a change that invalidates what this says updates it in the same PR.
Testing
cargo nextest run --all # Run all tests (preferred runner)
cargo nextest run -E 'test(name)' # Run a single test by name
cargo nextest run --all --profile ci # Run with CI profile
bats scripts/install.bats # Test install script (requires bats-core)
bats extensions/*/scripts/*.bats # Test the extensions' shell scripts
just test-scripts # Both of the above, the way CI runs them
Kernel and interface tests
The interface is Lua on a Rust kernel, so most coverage drives the real
kernel over the real ui/ rather than a harness that imitates either:
tests/kernel_mvp.rs— the kernel's contract: the four node kinds and their count, the plugin environment enumerated global-by-global (no blanket exemption for a leading underscore — that is how a capability once hid under__run_impl), the instruction/memory bounds, snapshot reads, and painting a plugin to aTestBackend.- The per-surface files — one file per surface or contract:
session_list,search,new_session,terminal_pane,session_lifetime,keymap,focus,modals,chrome,mouse,hover,decoration,plugin_{authoring,commands,lifecycle,settings,switching},repo_memory,remote_status,session_status,core_settings,attach_by_name. Several build an interface in a tempdir from the embedded copy, so delivery and loading are exercised together. tests/kernel_limits.rs— instruction and memory ceilings, in their own file because they mutate process-wide limits.- Lua statics —
selene ui(undefined names + the sandbox, viathurbox.yml),lua-language-server --check(types + withheld libraries),stylua(format). The three cover different halves; see Linting & Formatting. tests/frames.rs— the bundled panes' frames pinned cell for cell, as literals in the file (no snapshot tool): the session list grouped, nested, windowed, narrow and under double-width names; the selection as a style; the agent pane empty, detached, failed, and with a real vt100 screen behind its surface. A failing test prints the new frame as a literal to paste. Every input is pinned (thedefaultpreset by name, a fixedelapsed, a fixed snapshot) — keep it that way; a frame that moves on its own is worse than none.tests/render_props.rs— proptest crash invariants: every bundled pane renders and paints at any size down to one cell, the arrangement places its slots inside the screen and apart, no key sequence makes a pane throw (the creation flow included), and selection extraction survives arbitrary buffers and arbitrary vt100 byte streams.tests/tui_e2e.rs(unix) — the real binary on a real pty, vialibc'sopenpty(no PTY crate), fully isolated (private HOME/config/data, a short privateTMUX_TMPDIR, network and heartbeat features off). It asserts what noTestBackendtest can: the boot frame, the kernel overlays opening and closing, the search strip taking focus, a column toggle reflowing with no screen clear, a resize storm down to 1×1, a broken pane reported through the Interface tab, exit restoring the terminal (alternate screen, mouse, bracketed paste, cursor) — and, where tmux exists, a headlessly created session attached, painted and typed into (shas the agent). Alsojust smoke. It replaced the bash tmux smoke script, which could not see the byte stream and duplicated this harness.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 85 lines · 0 tokens per session scan A 875304fb4757
thurbox-testing is a skill published in the GitHub repository Thurbeen/thurbox (57 stars, last pushed 3d ago), licensed MIT. It adds 111 tokens to every session and 1,318 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
use-agent-browser-for-airi
Test AIRI display-model imports with agent-browser across stage-tamagotchi Electron, stage-web, and stage-pocket mobile web layouts. Use when uploading and verifying contributor-supplied Live2D ZIP, VRM, or MMD ZIP/PMX/PMD files through AIRI's model selector, including onboarding bypass, format-specific import…
test-conversion
Workflow for converting unit tests to browser tests for Project Bedrock. Invoke this when the user wants to remove complex Browser dependencies from tests.
agui-dotnet-cross-language-tests
Author cross-language interop tests that verify the AG-UI .NET SDK is wire-compatible with the TypeScript SDK — a Vitest TS client driving a C# CrossLanguage.TestServer over HTTP, both directions, including protobuf byte-parity against @ag-ui/proto. USE FOR: adding or modifying cross-language interop coverage…
cli-e2e-testcase-writer
Use when adding or updating Go CLI E2E coverage for one tests/clie2e/{domain} domain of the compiled lark-cli, especially when the work requires live --help or schema exploration, scenario-based clie2e.RunCmd workflows, and per-domain coverage.md maintenance.
harness-test-writer
Add regression test cases to the Bifrost provider harness (the Postman collection run via make run-provider-harness-test) based on a merged PR or a GitHub issue. Fetches the PR/issue, traces the affected wire path in the codebase, checks existing harness coverage, designs cases following harness conventions, inserts…
launch
Launch Code OSS (VS Code from sources) into an isolated throwaway profile with unique debug ports so you can drive it with @playwright/cli AND attach a Node debugger via dap-cli in the same session. Use when working on VS Code itself and you want to interact with the running workbench, automate chat or UI flows, test…