visual-audit

A visual quality checker for dashboard templates and their styling. It looks for layout, spacing, colour, design-system, and common AI-generated interface problems, then reports them for human review.

In plain words
What is it for?
Use it before a user-interface pull request, after broad template changes, or when checking selected dashboard pages or a branch's visual changes.
Why use it?
It helps find why a page looks inconsistent or unfinished without automatically changing the files.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/xsovad06/sova/visual-audit
Any agent
npx skills add xsovad06/sova --skill visual-audit
Clone the repo
git clone --depth 1 https://github.com/xsovad06/sova

Made for: Claude Code, Codex.

Per session 54 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,958 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00054 $0.01958
Opus 5 $0.00027 $0.00979
Sonnet 5 $0.00011 $0.00392
Haiku 4.5 $0.00005 $0.00196

Measured 2d ago against content hash 1c9954ae9991, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

visual-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/visual-audit/SKILL.md · 162 lines

How it starts

The opening of the file, as written. The whole thing — 162 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Visual Audit Protocol

Audit existing templates for design quality issues. Reports findings in a structured format for human review -- does not auto-fix.

When to Use

Invoke this skill when:

  • Asked to audit templates for visual quality
  • Before a major UI PR (run alongside /review)
  • After bulk template changes to catch regressions
  • When a page "looks off" but the issue is not obvious

Audit Procedure

Step 1: Scope

Determine which templates to audit:

  • Full audit: All templates in sova/dashboard/templates/ and sova/dashboard/static/
  • Targeted audit: Specific templates (e.g., agents.html, dashboard.html)
  • Diff audit: Only templates changed in the current branch (git diff --name-only main -- sova/dashboard/templates/ sova/dashboard/static/)

Step 2: Read References

Before auditing, read these files to understand the baseline:

  1. docs/design-system.md -- palette, typography, components
  2. sova/dashboard/static/style.css -- CSS variables, component classes
  3. .claude/skills/dashboard-design/SKILL.md -- quality rules and anti-slop bans

Step 3: Run Automated Checks

# Color violations: hardcoded hex/rgb/hsl outside Catppuccin palette
grep -rn --include='*.html' --include='*.js' --include='*.css' -E '(#[0-9a-fA-F]{3,8}|rgb\(|rgba\(|hsl\(|hsla\()' sova/dashboard/templates/ sova/dashboard/static/ | grep -v '{#' | grep -v 'style.css' | grep -v '_head.html'

# Inline event handlers in templates (except onclick with stopPropagation in JS-rendered HTML)
grep -rn --include='*.html' -E 'onchange=|onsubmit=|onkeydown=|onload=' sova/dashboard/templates/

# Native title attribute instead of data-tooltip
grep -rn --include='*.html' --include='*.js' 'title="' sova/dashboard/templates/ sova/dashboard/static/app.js | grep -v '<title>' | grep -v 'data-tooltip'

# transition: all (should specify properties)
grep -rn --include='*.html' --include='*.css' --include='*.js' 'transition:\s*all\b' sova/dashboard/templates/ sova/dashboard/static/

# Arbitrary spacing values
grep -rn --include='*.html' -E '(p|m|gap)-\[' sova/dashboard/templates/

# Font sizes below minimum
grep -rn --include='*.html' --include='*.css' -E 'text-\[(9|10|11)px\]|font-size:\s*(9|10|11)px' sova/dashboard/templates/ sova/dashboard/static/

# Banned shadow classes (SOVA uses border-based depth)
grep -rn --include='*.html' -E 'shadow-(md|lg|xl|2xl)' sova/dashboard/templates/ | grep -v '{#'

# Overflow hidden/auto/scroll on containers (may clip tooltips/popovers)
grep -rn --include='*.html' --include='*.css' -E 'overflow-(hidden|auto|scroll)|overflow:\s*(hidden|auto|scroll)' sova/dashboard/templates/ sova/dashboard/static/ | grep -v 'overflow-x-auto'

# Missing escapeHtml on dynamic content in innerHTML
grep -rn --include='*.html' --include='*.js' 'innerHTML.*+.*\b(item\.|agent\.|data\.|pr\.)' sova/dashboard/templates/ sova/dashboard/static/ | grep -v 'escapeHtml'

# Cost values without parseFloat guard
grep -rn --include='*.html' --include='*.js' '\.toFixed(' sova/dashboard/templates/ sova/dashboard/static/ | grep -v 'parseFloat'

# ASCII characters used as icons (arrows, checks, dots)
grep -rn --include='*.html' -E "'&#x2[0-9a-fA-F]{3};|&rarr;|&larr;|&check;|\\\\u2" sova/dashboard/templates/

Read the full file on GitHub · 162 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 162 lines · 54 tokens per session scan A 1c9954ae9991

Subscribe to this mod's changes

visual-audit is a skill published in the GitHub repository xsovad06/sova (2 stars, last pushed 2d ago), licensed Apache-2.0. It adds 54 tokens to every session and 1,958 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

codex-autonomous-dev

NightPilot / 夜航员: reusable autonomous Codex development workflow for long-running, unattended, goal-mode, overnight, full-auto, hands-off, low-interruption software development. Use when the user mentions NightPilot, 夜航员, $codex-autonomous-dev, codex-autonomous-dev, 全自动, 无人开发, 长时间开发, 目标模式, 撒手不管, 睡觉也能跑, 老工作流接管…

Dear-Ded/nightpilot-codex · 122 tokens

skill-integration

Patterns for agent skill discovery, referencing, and composition using progressive disclosure architecture. Use when building agents, composing skills, or optimizing context usage. TRIGGER when: skill discovery, agent integration, skill composition, progressive disclosure. DO NOT TRIGGER when: implementing features…

akaszubski/autonomous-dev · 64 tokens

api-design

REST API design best practices covering versioning, error handling, pagination, and OpenAPI documentation. Use when designing or implementing REST APIs or HTTP endpoints. TRIGGER when: API design, REST endpoint, HTTP route, OpenAPI, swagger, pagination. DO NOT TRIGGER when: internal library code, CLI tools, non-HTTP…

akaszubski/autonomous-dev · 71 tokens

api-integration-patterns

Subprocess safety, GitHub CLI integration, retry logic, authentication, rate limiting, and timeout handling. Use when integrating external APIs or CLI tools. TRIGGER when: subprocess, gh cli, API call, retry logic, rate limiting, authentication. DO NOT TRIGGER when: internal function calls, pure Python logic, config…

akaszubski/autonomous-dev · 74 tokens

agent-output-formats

Standardized output formats for research, planning, implementation, and review agents. Use when generating agent outputs or parsing agent responses.

akaszubski/autonomous-dev · 30 tokens

quality-scoring

Multi-dimensional data assessment for training quality evaluation including IFD scoring, factuality, and reasoning validation. Use when scoring training data or evaluating dataset quality. TRIGGER when: quality scoring, data assessment, IFD, factuality, training data quality. DO NOT TRIGGER when: code quality, test…

akaszubski/autonomous-dev · 72 tokens