Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add CavinHuang/lume --skill browsergit clone --depth 1 https://github.com/CavinHuang/lumeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cavinhuang/lume/browser)<a href="https://agentmods.dev/skills/cavinhuang/lume/browser"><img src="https://agentmods.dev/badge/skills/cavinhuang/lume/browser/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cavinhuang/lume/browser"><img src="https://agentmods.dev/badge/skills/cavinhuang/lume/browser.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00019 | $0.01000 |
| Opus 5.5 | $0.00008 | $0.00400 |
| Sonnet 5.5 | $0.00004 | $0.00200 |
| Haiku 4.5 | $0.00002 | $0.00100 |
Grade A, and why
browser scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 45 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Lume Browser
Use this skill for ordinary live web navigation and interaction. The Browser runtime is built into Lume and defaults to the shared persistent iab profile, so logins and site storage survive Lume restarts while tab control remains scoped to the current task. Use external Chrome only when the user explicitly requests Chrome or needs its current Chrome tabs, profile, or extensions.
Treat connection setup as internal. Do not mention Browser Broker or runtime plumbing in user-facing updates unless the user asks about the implementation.
Primary control loop: observe → act → observe
The mcp__browser__* tools are available for the whole user request. Never write browser JavaScript for ordinary interaction.
- Start with
mcp__browser__list_tabsto reuse the task's locked tab, ormcp__browser__open(url) when no suitable tab exists. - Call
mcp__browser__snapshotbefore interacting. Interactive nodes carry refs such as[ref=e12]. - Act by ref:
mcp__browser__click/double_click/hover/fill/type/press/select/check/scrollwithref: "@e12". - Every mutation tool returns a fresh interactive snapshot of the post-action page. Read it before the next action, and use only refs from the newest snapshot.
Large or dense pages: follow the snapshot's next_cursor by passing it as the cursor argument until the tree is exhausted; drill into one subtree with scope_ref; request interactive_only: true first when you only need actionable controls. mcp__browser__screenshot with annotated: true labels visible elements with the same refs for visual inspection — screenshots are never interaction targets.
Tab semantics
The session locks one active tab. open creates a new Agent-owned tab and locks it; switch_tab is the only way to move between Agent-owned tabs. A click that opens a new tab does not switch the lock — call list_tabs, then switch_tab. Navigation on the locked tab uses navigate / back / forward / reload.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 45 lines · 19 tokens per session scan A 30d7fa27a2ca
browser is a skill published in the GitHub repository CavinHuang/lume (3 stars, last pushed 1mo ago), licensed MIT. It adds 19 tokens to every session and 1,000 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
in-app-browser
A guide for using Proma’s built-in controlled web browser to open, view, search, or operate websites.
ha-browser
Hope Agent browser automation — the standard status → tabs → snapshot → act loop, stale-ref recovery rules, and what to do when login / 2FA / captcha / camera-prompt / dialog blocks progress. Load this skill whenever you reach for the browser tool. Trigger on: user asks the agent to open / control / click / scrape /…
guizang-ppt-skill
A skill for creating presentation decks as single HTML files that users can move through horizontally in a browser. It provides templates with WebGL backgrounds, chapter title screens, large data displays, and image grids, in either an editorial or Swiss-style visual direction.
proma-coach
A Chinese-language coach for improving how people use Proma, Agent, Skill, Chat, and project tools.
skill-creator
Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.
automation
A built-in workflow for creating and managing automatic or scheduled tasks. It covers one-time delays, repeated runs, monitoring, reminders, run history, and changing or stopping existing tasks.