Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add archimedes-run/omniHarness --skill web-app-buildergit clone --depth 1 https://github.com/archimedes-run/omniHarnessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/archimedes-run/omniharness/web-app-builder)<a href="https://agentmods.dev/skills/archimedes-run/omniharness/web-app-builder"><img src="https://agentmods.dev/badge/skills/archimedes-run/omniharness/web-app-builder.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00042 | $0.01679 |
| Opus 5 | $0.00021 | $0.00839 |
| Sonnet 5 | $0.00008 | $0.00336 |
| Haiku 4.5 | $0.00004 | $0.00168 |
Grade C, and why
web-app-builder scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf /mnt/user-data/outputs/my-vite-app How it starts
The opening of the file, as written. The whole thing — 171 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Web App Builder
Use this skill when the user asks to create a website, web app, dashboard, landing page, frontend prototype, or browser-based artifact that should be previewable in OmniHarness.
Artifact Layout
Always separate source code from exported artifacts:
- Source projects go under
/mnt/user-data/workspace/<artifact_id>. - Static preview outputs go under
/mnt/user-data/outputs/<artifact_id>. - Dynamic project manifests still live under
/mnt/user-data/outputs/<artifact_id>/artifact_manifest.jsoneven when the running app stays in workspace. - Every website, dashboard, or app artifact must include
/mnt/user-data/outputs/<artifact_id>/artifact_manifest.json.
Use a stable, lowercase artifact_id such as sales-dashboard, omniharness-next-site, or research-portal.
Required Manifest
Create this file in the output root for static sites:
{
"id": "artifact-id",
"title": "Human Friendly Project Title",
"type": "static_site",
"entrypoint": "index.html",
"root": ".",
"source_path": "/mnt/user-data/workspace/artifact-id",
"preview": {
"mode": "static"
},
"created_by": "agent"
}
Field reference — use exactly these key names:
| Field | Required | Notes |
|---|---|---|
id |
yes | Lowercase kebab-case. Must match the output folder name. |
title |
yes | Human-readable display name. NOT name — use title. |
type |
yes | "static_site" or "web_app". |
root |
yes | Relative path to the served root. Use "." for the output folder itself. |
entrypoint |
static only | Path to index.html relative to root. Required for static_site. |
source_path |
web_app only | Absolute workspace path of the project. Top-level field, NOT inside preview. |
preview.mode |
yes | "static" for static sites, "dev_server" for dynamic apps. |
preview.command |
web_app only | Dev-server start command, e.g. "npm run dev -- --hostname 0.0.0.0". |
preview.port |
web_app only | Port the dev server binds on, e.g. 3000. |
created_by |
no | Set to "agent". |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 171 lines · 42 tokens per session scan C 41f432765bdc
web-app-builder is a skill published in the GitHub repository archimedes-run/omniHarness (7 stars, last pushed 12d ago), licensed MIT. It adds 42 tokens to every session and 1,679 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it C with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
html-preview
A guidance skill for adding small, static HTML/CSS visual previews to Markdown when a diagram, comparison, timeline, metric display, or layout sketch would be clearer than text. It does not use JavaScript.
frontend-feature
Build a new page, view, or data-driven feature in the Next.js frontend. Use when adding a route under the dashboard/marketing area, wiring UI to a backend endpoint, adding client state, or creating a localized page. Covers App Router, data fetching, Zustand stores, and i18n.
add-error-tracking
Add Temps error tracking to applications using the Sentry-compatible SDK. Temps exposes a Sentry-compatible DSN that works with the official Sentry SDK for each language/framework — no code changes beyond initialization are required. Use when the user wants to: (1) Add error tracking to any app (React, Next.js, Vue…
add-react-analytics
Add Temps analytics to React applications with comprehensive tracking capabilities including page views, custom events, scroll tracking, engagement monitoring, session recording, and Web Vitals performance metrics. Use when the user wants to: (1) Add analytics to a React app (Next.js App Router, Next.js Pages Router…
add-session-recording
Add privacy-aware session recording and replay to React applications using the Temps SDK. Captures user interactions for playback while respecting privacy through input masking, element blocking, and GDPR-compliant consent flows. Use when the user wants to: (1) Add session recording to their app, (2) Implement session…
deploy-to-temps
Deploy applications to the Temps platform with automatic framework detection, Dockerfile generation, and container orchestration. Supports Next.js, Vite, React, Node.js, Python, Go, Rust, Java, and C# applications. Use when the user wants to: (1) Deploy their app to Temps, (2) Set up CI/CD with Temps, (3) Configure…