Audit Live Web Pages for Real Data

MockHunter is a live-page audit skill that checks whether visible values are backed by real data, mocked, generated, hardcoded, broken, or unresolved. It uses a browser to catalog the interface, observe approved interactions, and trace values through network responses and DOM evidence. The report assigns REAL, MOCK, LLM, HARDCODED, BROKEN, or UNKNOWN verdicts alongside sources and recommended actions.

The workflow starts with a target URL and questions about authentication, optional database access, suspicions, and the page's purpose. It recognizes several application-building platforms from the URL and otherwise treats the stack as custom. Navigation captures a full-page screenshot, accessibility snapshot, console errors, and network requests. The inventory includes headings, controls, cards, badges, statistics, tables, empty states, and images.

Use it to inspect generated interfaces, review a teammate's or contractor's deliverable, or assess an MVP before a customer or investor demonstration. Uniformly round metrics, clustered timestamps, and unusually repetitive rows are reasons to investigate provenance. They are heuristic flags rather than conclusive proof.

The default is observation-only until ownership or permission, a safe environment or account, and allowed action classes are confirmed. Navigation clicks and potentially mutating authenticated actions need explicit approval. Destructive, ambiguous, icon-only, localized, or external-write controls are skipped unless the exact control and environment are allowlisted. Payment, account deletion, account changes, invites, publishing, deployment, messaging, and money-movement forms are never submitted.

The audit is limited to one page, roughly 30 prominent buttons, and Markdown output. Authentication supports form login rather than OAuth, magic links, or two-factor flows. A failed page load makes the audit unreliable and requires examining console errors first.

Inputs include the URL, authentication mode, page goal, suspected sections, permissions, and optional database connection. A dedicated test account and disclosure of intentionally generated content help reduce false conclusions. Empty-state testing is recommended because apparently complete pages may behave differently without seeded data.

For a value found in a response, the decision tree checks failures, generation endpoints, mock-library patterns, uniformity, and optional database matches. Database checks use read-only SELECT operations. Without enough evidence, the verdict remains UNKNOWN. Values absent from responses are checked for source literals or generation through mechanisms such as Math.random, Date.now, or faker.

The resulting mockhunter-report.md includes verdict counts, section-level findings with value, source, severity, and action, console and network failures, no-op controls, suspicious patterns, and follow-up questions. Approved interaction checks record each element's behavior and re-catalog tabs after navigation.

The skill uses Claude Code and Playwright MCP in a controlled browser context. Its navigation tool is:

browser_navigate

Named platform examples include Lovable, Bolt, v0, Replit, AI Studio, and Cursor Composer. Provenance checks reference faker, MSW, and mockoon patterns. Optional database verification can use shell-reachable systems through psql, mysql, mongosh, wrangler, or Supabase REST; direct Firestore verification is excluded.

It serves people reviewing web interfaces whose visual completeness may conceal incomplete data wiring. It is useful for deliverable sign-off and MVP review when evidence about visible values matters as much as the appearance of the page.