Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/xsovad06/sova/visual-auditnpx skills add xsovad06/sova --skill visual-auditgit clone --depth 1 https://github.com/xsovad06/sovaWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00054 | $0.01958 |
| Opus 5 | $0.00027 | $0.00979 |
| Sonnet 5 | $0.00011 | $0.00392 |
| Haiku 4.5 | $0.00005 | $0.00196 |
Grade A, and why
visual-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 162 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Visual Audit Protocol
Audit existing templates for design quality issues. Reports findings in a structured format for human review -- does not auto-fix.
When to Use
Invoke this skill when:
- Asked to audit templates for visual quality
- Before a major UI PR (run alongside
/review) - After bulk template changes to catch regressions
- When a page "looks off" but the issue is not obvious
Audit Procedure
Step 1: Scope
Determine which templates to audit:
- Full audit: All templates in
sova/dashboard/templates/andsova/dashboard/static/ - Targeted audit: Specific templates (e.g.,
agents.html,dashboard.html) - Diff audit: Only templates changed in the current branch (
git diff --name-only main -- sova/dashboard/templates/ sova/dashboard/static/)
Step 2: Read References
Before auditing, read these files to understand the baseline:
docs/design-system.md-- palette, typography, componentssova/dashboard/static/style.css-- CSS variables, component classes.claude/skills/dashboard-design/SKILL.md-- quality rules and anti-slop bans
Step 3: Run Automated Checks
# Color violations: hardcoded hex/rgb/hsl outside Catppuccin palette
grep -rn --include='*.html' --include='*.js' --include='*.css' -E '(#[0-9a-fA-F]{3,8}|rgb\(|rgba\(|hsl\(|hsla\()' sova/dashboard/templates/ sova/dashboard/static/ | grep -v '{#' | grep -v 'style.css' | grep -v '_head.html'
# Inline event handlers in templates (except onclick with stopPropagation in JS-rendered HTML)
grep -rn --include='*.html' -E 'onchange=|onsubmit=|onkeydown=|onload=' sova/dashboard/templates/
# Native title attribute instead of data-tooltip
grep -rn --include='*.html' --include='*.js' 'title="' sova/dashboard/templates/ sova/dashboard/static/app.js | grep -v '<title>' | grep -v 'data-tooltip'
# transition: all (should specify properties)
grep -rn --include='*.html' --include='*.css' --include='*.js' 'transition:\s*all\b' sova/dashboard/templates/ sova/dashboard/static/
# Arbitrary spacing values
grep -rn --include='*.html' -E '(p|m|gap)-\[' sova/dashboard/templates/
# Font sizes below minimum
grep -rn --include='*.html' --include='*.css' -E 'text-\[(9|10|11)px\]|font-size:\s*(9|10|11)px' sova/dashboard/templates/ sova/dashboard/static/
# Banned shadow classes (SOVA uses border-based depth)
grep -rn --include='*.html' -E 'shadow-(md|lg|xl|2xl)' sova/dashboard/templates/ | grep -v '{#'
# Overflow hidden/auto/scroll on containers (may clip tooltips/popovers)
grep -rn --include='*.html' --include='*.css' -E 'overflow-(hidden|auto|scroll)|overflow:\s*(hidden|auto|scroll)' sova/dashboard/templates/ sova/dashboard/static/ | grep -v 'overflow-x-auto'
# Missing escapeHtml on dynamic content in innerHTML
grep -rn --include='*.html' --include='*.js' 'innerHTML.*+.*\b(item\.|agent\.|data\.|pr\.)' sova/dashboard/templates/ sova/dashboard/static/ | grep -v 'escapeHtml'
# Cost values without parseFloat guard
grep -rn --include='*.html' --include='*.js' '\.toFixed(' sova/dashboard/templates/ sova/dashboard/static/ | grep -v 'parseFloat'
# ASCII characters used as icons (arrows, checks, dots)
grep -rn --include='*.html' -E "'[0-9a-fA-F]{3};|→|←|✓|\\\\u2" sova/dashboard/templates/
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 162 lines · 54 tokens per session scan A 1c9954ae9991
visual-audit is a skill published in the GitHub repository xsovad06/sova (2 stars, last pushed 2d ago), licensed Apache-2.0. It adds 54 tokens to every session and 1,958 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
codex-autonomous-dev
NightPilot / 夜航员: reusable autonomous Codex development workflow for long-running, unattended, goal-mode, overnight, full-auto, hands-off, low-interruption software development. Use when the user mentions NightPilot, 夜航员, $codex-autonomous-dev, codex-autonomous-dev, 全自动, 无人开发, 长时间开发, 目标模式, 撒手不管, 睡觉也能跑, 老工作流接管…
skill-integration
Patterns for agent skill discovery, referencing, and composition using progressive disclosure architecture. Use when building agents, composing skills, or optimizing context usage. TRIGGER when: skill discovery, agent integration, skill composition, progressive disclosure. DO NOT TRIGGER when: implementing features…
api-design
REST API design best practices covering versioning, error handling, pagination, and OpenAPI documentation. Use when designing or implementing REST APIs or HTTP endpoints. TRIGGER when: API design, REST endpoint, HTTP route, OpenAPI, swagger, pagination. DO NOT TRIGGER when: internal library code, CLI tools, non-HTTP…
api-integration-patterns
Subprocess safety, GitHub CLI integration, retry logic, authentication, rate limiting, and timeout handling. Use when integrating external APIs or CLI tools. TRIGGER when: subprocess, gh cli, API call, retry logic, rate limiting, authentication. DO NOT TRIGGER when: internal function calls, pure Python logic, config…
agent-output-formats
Standardized output formats for research, planning, implementation, and review agents. Use when generating agent outputs or parsing agent responses.
quality-scoring
Multi-dimensional data assessment for training quality evaluation including IFD scoring, factuality, and reasoning validation. Use when scoring training data or evaluating dataset quality. TRIGGER when: quality scoring, data assessment, IFD, factuality, training data quality. DO NOT TRIGGER when: code quality, test…