Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add apexcheng/yingdao-xbot-ai-agent --skill web-workflow-extractiongit clone --depth 1 https://github.com/apexcheng/yingdao-xbot-ai-agentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/apexcheng/yingdao-xbot-ai-agent/web-workflow-extraction)<a href="https://agentmods.dev/skills/apexcheng/yingdao-xbot-ai-agent/web-workflow-extraction"><img src="https://agentmods.dev/badge/skills/apexcheng/yingdao-xbot-ai-agent/web-workflow-extraction/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/apexcheng/yingdao-xbot-ai-agent/web-workflow-extraction"><img src="https://agentmods.dev/badge/skills/apexcheng/yingdao-xbot-ai-agent/web-workflow-extraction.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00052 | $0.01180 |
| Opus 5.5 | $0.00021 | $0.00472 |
| Sonnet 5.5 | $0.00010 | $0.00236 |
| Haiku 4.5 | $0.00005 | $0.00118 |
Grade A, and why
web-workflow-extraction scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
网页流程探测与 XPath 提取
触发与职责
- 仅显式触发:用户明确要求网页操作流程探测、XPath 提取或验证时执行;普通网页开发不自动触发。
- 只交付操作步骤、XPath、页面状态与验证证据文档,供后续影刀开发参考;不编写或修改 RPA 代码,不运行影刀或部署。
- 以用户提供的业务目标、已确认的页面路径和当前环境为边界。可复用已有探测结果,但未经当前页面核实的选择器不能标为本次实测通过。
探测流程
- 确认起点:明确目标网页、入口、登录状态、操作范围、必要输入及预期完成状态。沿用已确认事项;影响业务结果或副作用的缺口先向用户确认。使用当前环境已授权的浏览器操作能力。
- 识别页面状态:确认目标元素位于主文档、iframe、弹窗还是新标签页;注意加载、遮挡、禁用状态及动态刷新。只检查当前步骤真正涉及的结构。
- 提取并检查定位:依据当前真实 DOM 提取 XPath,记录作用范围和命中数量;单目标必须唯一,多目标须符合预期范围。操作前检查目标语义及所需可操作状态(如可见、未被遮挡、可编辑或未禁用);定位原则见下方正式文档。
- 逐步实际操作:在用户授权范围内允许所有交互类型,包括点击、输入、提交、下载等,示例不是白名单。按业务顺序执行并记录必要输入;已有授权不重复询问,授权不明的步骤先确认。
- 验证闭环:按该步等待条件观察操作后的实际状态,对照成功判据留存证据;XPath 命中或动作调用成功都不能单独证明流程成功。可能重复提交的动作不为验证而重做;结果不明时先核实状态,不盲目重试。
- 处理阻塞:唯一性、可操作性或操作后状态不符合预期时,记录失败证据并暂停依赖该结果的步骤;页面变化时重新核实 DOM,不推断未观察到的结构或结果。
XPath 与影刀边界
- 元素库复用、XPath 构造及相对查找原则统一见 browser.md。已有元素库名称可作为线索,不能冒充已提取的 XPath;无法取得 XPath 时标明缺口。
- iframe 按外到内分别记录各层 iframe XPath 与框内目标 XPath,并在各自上下文核对匹配;调用契约见 iframe2-extension.md,不将跨文档路径拼成普通 XPath。
- 业务取数、异步导出任务绑定及动态元素处理按需查 网页自动化实践;提取交互 XPath 不等于选择 XPath 读取业务数据,不额外扩展取数任务。
- 探测 Excel/CSV 导出流程时,不为额外核验文件格式、表头或数据而下载真实报表;交付时提示“真实导出文件结构未验证,首次运行可能需适配”。用户明确要求实际下载或文件核验时除外。
- 浏览器探测通过不代表影刀运行通过;标明验证环境及影刀兼容性未验证的范围,不为补充兼容性结论运行 RPA。
交付格式
先简述目标、起止状态和验证环境,再用简短步骤表交付;不倾倒整段 DOM。表中为格式示意:
| 步骤 | 前置状态、操作与输入 | XPath / 作用范围 | 等待与成功判据 | 结果与证据 |
|---|---|---|---|---|
| 序号 | 当前状态 → 动作(必要输入) | 实测 XPath;页面 / iframe / 相对根节点 | 等待条件;预期完成状态 | 状态;命中数、可操作性、操作后观察及证据引用 |
- 证据使用必要的 DOM 摘要、截图引用、响应摘要或下载结果引用,注明对应步骤并脱敏;明确区分预期与实际观察,不记录凭据或敏感业务原文。
- 结果状态:
已实测(唯一性或多目标范围、可操作性及动作后状态均通过)、仅定位(已核实 XPath,未执行动作)、待验证(尚未完成检查,注明阻塞)、失败(检查或动作结果不符合预期)。静态材料不能冒充真实页面实测。 - 仅补充影响复用的页面差异、未覆盖分支及阻塞;不将单次探测推断为所有页面或店铺通用。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 42 lines · 52 tokens per session scan A 6f1a72f4eb02
web-workflow-extraction is a skill published in the GitHub repository apexcheng/yingdao-xbot-ai-agent (42 stars, last pushed yesterday), licensed MIT. It adds 52 tokens to every session and 1,180 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-20.
Other skills, from other repositories
browser-use
Direct browser control via CDP for web interaction: automation, scraping, testing, screenshots, and site/app work. Also covers hosted cloud browsers for AI agents: the browser-use Python library (Browser(usecloud=True)), Playwright, Puppeteer or any CDP client.
browse
Use the browse CLI for Browserbase browser automation, Browserbase cloud APIs, Browserbase Functions, templates, web fetch/search, diagnostics, and Browse.sh skill discovery/installation. Use when the user asks to navigate pages, inspect browser state, run local or remote browser sessions, manage Browserbase…
opencli-autofix
Automatically fix broken OpenCLI adapters when commands fail. Load this skill when an opencli command fails — it guides you through collecting a trace artifact, patching the adapter, retrying, and filing an upstream GitHub issue after a verified fix. Works with any AI agent.
skill-body
Call help() or help("page.click") to print signatures and uncommon options of APIs named below; it prints by itself, so do not wrap it in console.log. For installation or connection problems, read references/install.md in the ego-browser Skill directory.
moli-webfetch
Fetch, inspect, crawl, and capture live, JavaScript-rendered websites with Moli. Use when Codex needs current web content, web research, fact lookup, link following, a bounded crawl, client-rendered or response-gated content, network diagnostics, or a standalone HTML, Markdown, JSON, semantic-tree, viewport or…
pinchtab
Use this skill when a task needs browser automation through PinchTab: open a website, inspect interactive elements, click through flows, fill out forms, scrape page text, reuse a dedicated automation profile with user approval, export screenshots or PDFs, manage multiple browser instances, or fall back to the HTTP API…