Audit Live Web Pages for Real Data

MockHunter audits a live web page and classifies every visible value - stats, metrics, table cells, badges, headings - as REAL, MOCK, LLM-generated, HARDCODED, BROKEN, or UNKNOWN. It catalogs all UI elements, tests interactivity (clicks, form submissions), traces each value through network requests and DOM sources, then outputs a markdown report with verdicts, console errors, NO-OP buttons, and suspicious patterns. Built for vibe-coded apps from Lovable, Bolt, v0, Replit, AI Studio, and Cursor Composer where the UI may look complete but the data layer often is not.

Use MockHunter when auditing an AI-generated UI to find out which values are actually wired up, reviewing a contractor's deliverable before sign-off, preparing a vibe-coded MVP for customers or investors, or when a dashboard looks too clean (every metric uniformly round, all timestamps clustered, no variance). Use before showing work to stakeholders when you suspect seeded data.

Do NOT run active interaction on apps you don't own without permission - live clicks and form submissions can mutate state. Do NOT trust the audit if the page failed to load; check console first. Do NOT run on production systems without a dedicated test account and explicit approval for each form submission.

You provide the target URL, authentication mode (public, localhost, form-login, or skip), optional database connection details, and approval for interaction classes (navigation, non-destructive clicks, form submissions).

You receive a markdown report (mockhunter-report.md) with a summary table of verdict counts, findings per section (element, value, verdict, source, severity, action), console errors, network failures, NO-OP buttons, suspicious patterns, and smart follow-up questions.

MockHunter runs a five-phase audit. Phase 1 gathers context and confirms the audit plan. Phase 2 navigates to the target, handles auth, waits for network idle, takes a full-page screenshot, and inventories every heading, button, link, input, card, badge, stat, table cell, empty state, and image. Phase 3 tests interactivity by clicking tabs, buttons (user-approved, non-destructive only), and submitting forms (with throwaway data, only when explicitly approved). Phase 4 traces provenance using this decision tree:

Did any network request return this value?
├── YES - found in a response:
│   ├── Status 4xx/5xx → BROKEN
│   ├── Endpoint matches /ai|openai|generate|llm|chat → LLM
│   ├── Response shape matches mock library (faker, MSW, mockoon) → MOCK
│   ├── Uniformity flags trigger → MOCK or LLM (review)
│   ├── DB connection provided?
│   │   ├── Run read-only SELECT, value matches DB row → REAL
│   │   └── Value not in DB → MOCK
│   └── No DB → UNKNOWN (best-guess)
└── NO - value not in any network response:
    ├── String literal in DOM source → HARDCODED
    ├── Computed from Math.random / Date.now / faker → MOCK
    └── Cannot determine → UNKNOWN

Uniformity heuristics flag suspicious data: all numeric values identical across rows, all percentages round (50%, 75%, 90%), all timestamps cluster within a single minute, or fewer than 3 unique values across 10+ rows. Phase 5 generates the report.

MockHunter uses Playwright MCP to drive a real browser. Database verification is optional and supports shell-accessible databases. The skill performs read-only operations only.

MockHunter is for teams auditing AI-generated UIs, especially those using vibe-coding tools (Lovable, Bolt, v0, Replit, AI Studio, Cursor Composer) where the UI ships fast but data wiring lags. Provide database access when available to lift UNKNOWN verdicts to REAL or MOCK. Use a dedicated test account for form-login auth and run cold-start tests (zero data) to catch failures.