Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/tph-kds/deckforge/deckforge-visual-evidencenpx skills add tph-kds/deckforge --skill deckforge-visual-evidencegit clone --depth 1 https://github.com/tph-kds/deckforgeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00071 | $0.00319 |
| Opus 5 | $0.00036 | $0.00160 |
| Sonnet 5 | $0.00014 | $0.00064 |
| Haiku 4.5 | $0.00007 | $0.00032 |
Grade A, and why
deckforge-visual-evidence scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
deckforge-visual-evidence
Verification worker. Prove a generated DeckForge application works by executing it.
- Determine changed surfaces and the required capabilities from the capability catalog.
- Start the target application on an isolated port (do not reuse a shared server).
- Run behavior-focused editor, presenter, viewer, and export-preview scenarios via Playwright.
- Capture the required viewports and a reduced-motion run.
- Record console errors, failed requests, and timing.
- Retry each candidate defect once before reporting.
- Annotate evidence with slide, block, and capability IDs.
- Generate
browser-evidence-report.jsonand per-capability evidence entries. - Stop all created processes and browser contexts.
- Mark unavailable checks
unverified, neverpassed.
Read references/browser-evidence-contract.md and the report schema at
../../schemas/browser-evidence-report.schema.json. Map Playwright tests to
capabilities with assets/evidence-capability-map.json.
Never claim a check ran when the browser, runner, or port was unavailable.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 29 lines · 71 tokens per session scan A 6b56b723ab96
deckforge-visual-evidence is a skill published in the GitHub repository tph-kds/deckforge (4 stars, last pushed 16d ago), licensed MIT. It adds 71 tokens to every session and 319 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
npm
Skill "npm" from dhaupin/vant, covering npm, when to use, what to do, 1. common commands and 2. install.
release-bilibili
Save one prepared Bilibili video submission to the Creator draft box through the currently authenticated browser; use for reliable ordered video upload, autonomous cover and metadata completion, platform-limit adaptation, draft validation, and single draft saving.
release-v2ex
Publish one prepared text topic to an explicitly selected V2EX node through the currently authenticated browser session; use for node validation, exact text population, single submission, and outcome classification.
foreman-web-testing
Headless end-to-end / web-app testing for the Foreman e2e stage. Derive end-to-end tests from the PRD's User Flows, drive the real application the way a user would (browser flows, screenshots, accessibility checks for web apps), make them pass via the configured e2e command, and emit the FOREMAN-SUMMARY block Foreman…
extract-spa-docs
Extract documentation from rendered SPA or app-driven docs sites into local Markdown under a site-named docs folder. Use when docs live in an app UI or docs website with no source Markdown available, and an agent must drive a real browser for route discovery, DOM extraction, content cleanup, and link rewriting. Works…
Agent Browser
A fast Rust-based headless browser automation CLI with Node.js fallback that enables AI agents to navigate, click, type, and snapshot pages via structured commands.