Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/agentcomputerai/torch/stockxnpx skills add AgentComputerAI/torch --skill stockxgit clone --depth 1 https://github.com/AgentComputerAI/torchWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00136 | $0.02221 |
| Opus 5 | $0.00068 | $0.01111 |
| Sonnet 5 | $0.00027 | $0.00444 |
| Haiku 4.5 | $0.00014 | $0.00222 |
Grade A, and why
stockx scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
description: Proven scraping playbook for stockx.com listing pages (e.g. /sneakers/most-active, /sneakers/release-date, category leaderboards). Cloudflare hard-blocks bare curl with `cf-mitigated: challenge` + HTTP 403, How it starts
The opening of the file, as written. The whole thing — 147 lines — stays where its author put it; the contents beside it link to each section on GitHub.
StockX (stockx.com)
StockX is a Next.js SPA behind Cloudflare with aggressive bot scoring. Curl is rejected at L7 with a
cf-mitigated: challengeheader. But a real Chrome session (via127.0.0.1:9222) is let straight through — no challenge page, no captcha, no IUAM interstitial. All product tiles are in the initial DOM after hydration and can be scraped withpage.evaluate(). Don't bother with__NEXT_DATA__— on listing pages it only contains i18n and req metadata, not the product list.
Detection
| Signal | Value |
|---|---|
| CDN | Cloudflare (server: cloudflare, cf-ray) |
| Framework | Next.js (has __NEXT_DATA__, /_next/ assets, buildId) |
| Anti-bot | Cloudflare Bot Management (cf-mitigated: challenge on curl) |
| Curl status | HTTP 403 on every bare request |
| Real Chrome | ✅ 200 OK, full HTML, no interstitial |
| Auth required | No |
| Rate limit | Not hit during normal scraping cadence |
Architecture
- Next.js SSR + hydration. The server sends full HTML with
[data-testid="productTile"]tiles for the first page of results. - Listings like
/sneakers/most-activereturn 40 tiles with no pagination link and no lazy-load extension — that's the full leaderboard for this view. - Paginated categories use
?page=Nbut additional pages can hang intermittently onnetworkidle2; usedomcontentloaded+waitForSelectorinstead. __NEXT_DATA__on listing pages contains only{ req, _nextI18Next }underpageProps. Not useful. Scrape the DOM.- Product detail pages and the GraphQL endpoint (
/api/graphql) are a separate story — this skill only covers listing tiles.
Strategy used
- Phase 0 (curl): 403 +
cf-mitigated: challenge. Skip. - Phase 1 (framework): Next.js, but
__NEXT_DATA__is empty of product data. Skip. - Phase 2 (browser):
puppeteer.connect({ browserURL: the real Chrome debug port }). Works on the first try with zero evasion. Don't bother with the stealth plugin fallback — a disposable Chromium gets hard-blocked by Cloudflare here.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 147 lines · 0 tokens per session scan A 0b417f62613b
stockx is a skill published in the GitHub repository AgentComputerAI/torch (5 stars, last pushed 4mo ago), licensed MIT. It adds 136 tokens to every session and 2,221 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
agentos-expeditor
Coordinate AgentOS fulfillment and delivery work with milestones, supplier and courier tracking, exception handling, recovery options, Procurement handoffs, escalation approvals, evidence, and receipt closure. Use for order delays, shipment tracking, vendor exceptions, and delivery recovery.
agentos-procurement
Source products and services in AgentOS through scoped requirements, supplier discovery, invite-to-tender, quote comparison, buy-versus-make analysis, purchase proposals, and commercial approval. Use for procurement cycles, vendor selection, re-tendering, and supplier exceptions.
product-specialist
Product and commerce domain coordination for catalog, plans, pricing, inventory, orders, vouchers, fulfillment, and procurement handoffs. Use when designing product specialist sub-agents, routing commerce tasks, defining ownership boundaries, or coordinating product operations.
fulfillment-expeditor-specialist
Shipment, delivery, provider evidence, delay detection, recovery options, and fulfillment exception coordination. Use when reconciling tracking, managing delays, coordinating suppliers, or closing fulfillment exceptions.
catalog-specialist
Product catalog, SKU, plan, offer, eligibility, and availability management. Use when defining or reviewing product metadata, product hierarchy, plans, bundles, or catalog publication workflows.
inventory-specialist
Inventory, stock, capacity, reservations, availability, and reconciliation management. Use when checking, reserving, releasing, reconciling, or forecasting product or service availability.