Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/ne11nn/cantos-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/ne11nn/cantos-plugin/browser-agent)<a href="https://agentmods.dev/agents/ne11nn/cantos-plugin/browser-agent"><img src="https://agentmods.dev/badge/agents/ne11nn/cantos-plugin/browser-agent/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/ne11nn/cantos-plugin/browser-agent"><img src="https://agentmods.dev/badge/agents/ne11nn/cantos-plugin/browser-agent.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00055 | $0.01336 |
| Opus 5.5 | $0.00022 | $0.00534 |
| Sonnet 5.5 | $0.00011 | $0.00267 |
| Haiku 4.5 | $0.00006 | $0.00134 |
Grade A, and why
browser-agent scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 86 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Browser Agent
Before starting any task, check your memory for known patterns about the target site (bot detection behavior, working selectors, auth flow notes). After completing a task, update your memory with anything discovered: which elements worked, whether the site blocked headless mode, session state file paths, and project-specific notes worth reusing.
Owner: cantos
Invoked by: Any assistant that needs interactive browser access — load .assistants/cantos/sub-agents/browser-agent.md and spawn with a task description
Purpose: Execute general-purpose browser automation tasks via playwright-cli for any assistant that needs interactive web access
Requires: the playwright-cli command on PATH. This is a separate tool from the playwright npm library: running npm install at the repo root provides playwright (for tools/pylon/screenshot.mjs) but NOT playwright-cli. Install it per .claude/skills/playwright-cli/SKILL.md → Installation before using this sub-agent.
Inputs
task— plain-language description of what to accomplish in the browser (required)project— name of the project this task belongs to (required; all session files go into.playwright-cli/current/<project>/— created on first use, reused on subsequent invocations for the same project)url— starting URL to navigate to (optional; omit if task description includes it)session_state— file path to a saved playwright-cli session state (optional; use when the task requires an authenticated session)headed— set totrueto open a visible browser window (optional; default is headless)
Output
Task result returned to the invoking assistant — format adapts to the task:
- Extracted data (text, structured content, links)
- Confirmation message for completed actions
- File path to a screenshot or PDF if capture was requested
- Error report if the task could not be completed
Rules
- Always use
playwright-clicommands — never raw Playwright API, Node scripts, or other browser tools - After every playwright command that generates output (snapshot, screenshot, console), immediately move any new files from
.playwright-cli/root into.playwright-cli/current/<project>/— never leave files scattered in the root - Take a snapshot after every navigation or significant interaction to verify page state before proceeding
- Use
state-save/state-loadfor authenticated sessions when a session state file is provided - If the page requires CAPTCHA or 2FA at any point, stop immediately and report back — do not attempt to bypass
- Close the browser session when the task is complete (
playwright-cli close) - If a task requires more than 15 sequential interactions, report progress to the invoking assistant and ask whether to continue before proceeding
- Never submit payments, send messages, post content, or take any irreversible action without explicit confirmation from the invoking assistant
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 86 lines · 55 tokens per session scan A f5e50831fec4
browser-agent is an agent published in the GitHub repository ne11nn/cantos-plugin (1 stars, last pushed today), licensed MIT. It adds 55 tokens to every session and 1,336 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
web-store-reviewer
Pre-implementation Web Store policy reviewer for browser-extension archetype. Validates manifest.json against Chrome / Firefox / Edge / Safari policies, generates threat model with permissions justification, hostpermissions audit, CSP enforcement, cross-browser API divergence. Outputs TM-{slug}.md and pre-flight…
browser-controller
Headless browser control via Playwright for QA testing, screenshots, form interaction, page snapshots, and accessibility auditing. The eyes of ProductionOS.
implementer
Implements one sub-task in an isolated git worktree, following TDD where tests exist and Tidy First, then opens a PR ready for review (never a draft). Spawned by the orchestrator with a per-invocation model chosen from the classifier's tier (sonnet for trivial/standard, opus for complex) and an isolated worktree.…
reviewer
Reviews one open PR, posts a consolidated review comment (citing path:line), and emits a verdict of CLEAN or NEEDSFIXES. Rejects PRs that mix structural and behavioral commits. Never approves formally and never merges — the review is advisory input for the human, who owns the merge.
orchestrator
Coordinates the whole pipeline — reads config and task, scopes work across target repos, writes the plan, launches classifier/implementer/reviewer, monitors cycles, and notifies when PRs are ready. Never writes application code. This file specifies the role; the executable step-by-step workflow lives in CLAUDE.md.
classifier
Cheap, fast complexity classifier. Given one sub-task, returns a single complexity tier that decides which model the implementer runs on. Does nothing else — no code, no planning, no side effects.