How do I install the Sniff skill?

Run npx skillmds@latest add aboudjem/sniff in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Sniff safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Sniff?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Sniff free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

aboudjem (@aboudjem) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Sniff by aboudjem — Agent Skill

Name: Sniff
Author: aboudjem

Sniff

Use when the user types /sniff, or asks to "scan this project for bugs", "find bugs in my app", "QA my site", or "walk my app and tell me what's broken". For a running web app, finds real, reproducible issues (broken pages/links, console & network errors, broken forms, empty/placeholder data, state-loss, bad loading/error states, responsive and accessibility problems), each with reproduction proof, severity, confidence, and a fix. No API key needed.

aboudjem d2ba9ad 2.2 KB Updated Sep 17, 2026

File contents

/sniff: find real bugs in this project

What to do

Call the unified sniff MCP tool with:
- mode: "walk", the autonomous flow-walk that drives a real browser and finds runtime bugs (this is the one that matters; "scan" is source-only)
- rootDir: the current project's absolute path
- omit baseUrl to auto-detect the running dev server, or pass it if the user gives a URL
If the response is { needsSetup: "playwright-browsers" }, call the sniff_install tool, then retry the walk.
If no app is running, sniff returns a note + a source-only scan. Tell the user to start their dev server (or pass a URL) for the full flow-walk that finds the real runtime bugs.
Present findings grouped by severity (CRITICAL and HIGH first). For each, show the route, the reproduction steps, the confidence (confirmed / likely / uncertain), and the suggested fix. Mention any finding marked needsOutOfBandVerification (e.g. "submitted but no success shown, confirm the email/job actually ran"). Offer /sniff-fix for the safe, auto-fixable ones.

Example

User: /sniff
You: Walking your running app for real bugs…

[calls sniff with mode="walk", rootDir=/Users/user/projects/my-app]

Found 9 real issues (0 false positives) across 12 pages:

**Critical (1)**
- /checkout: Page returns HTTP 500 (crash screen shown to the user)

**High (3)**
- /: Broken link → /pricing-old (HTTP 404)
- /dashboard: Uncaught exception: cannot read 'map' of undefined
- /signup: Submit button does nothing (no request, no message, no change)

**Medium (5)**
- /orders: Empty table with no empty-state ("Your Orders")
- /profile: Placeholder data shipped (test@test.com)
- …each with reproduction steps + a screenshot + a fix.

Want me to fix the safe ones with /sniff-fix?

---name: sniffdescription: Use when the user types /sniff, or asks to "scan this project for bugs", "find bugs in my app", "QA my site", or "walk my app and tell me what's broken". For a running web app, finds real, reproducible issues (broken pages/links, console & network errors, broken forms, empty/placeholder data, state-loss, bad loading/error states, responsive and accessibility problems), each with reproduction proof, severity, confidence, and a fix. No API key needed.---# /sniff: find real bugs in this project## What to do1. Call the unified `sniff` MCP tool with: - `mode`: `"walk"`, the autonomous flow-walk that drives a real browser and finds runtime bugs (this is the one that matters; `"scan"` is source-only) - `rootDir`: the current project's absolute path - omit `baseUrl` to auto-detect the running dev server, or pass it if the user gives a URL2. If the response is `{ needsSetup: "playwright-browsers" }`, call the `sniff_install` tool, then retry the walk.3. If no app is running, sniff returns a note + a source-only scan. Tell the user to start their dev server (or pass a URL) for the full flow-walk that finds the real runtime bugs.4. Present findings grouped by severity (CRITICAL and HIGH first). For each, show the **route**, the **reproduction steps**, the **confidence** (confirmed / likely / uncertain), and the **suggested fix**. Mention any finding marked `needsOutOfBandVerification` (e.g. "submitted but no success shown, confirm the email/job actually ran"). Offer `/sniff-fix` for the safe, auto-fixable ones.## Example```User: /sniffYou: Walking your running app for real bugs…[calls sniff with mode="walk", rootDir=/Users/user/projects/my-app]Found 9 real issues (0 false positives) across 12 pages:**Critical (1)**- /checkout: Page returns HTTP 500 (crash screen shown to the user)**High (3)**- /: Broken link → /pricing-old (HTTP 404)- /dashboard: Uncaught exception: cannot read 'map' of undefined- /signup: Submit button does nothing (no request, no message, no change)**Medium (5)**- /orders: Empty table with no empty-state ("Your Orders")- /profile: Placeholder data shipped (test@test.com)- …each with reproduction steps + a screenshot + a fix.Want me to fix the safe ones with /sniff-fix?```

Frequently asked questions