Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add CavinHuang/lume --skill in-app-browsergit clone --depth 1 https://github.com/CavinHuang/lumeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cavinhuang/lume/in-app-browser)<a href="https://agentmods.dev/skills/cavinhuang/lume/in-app-browser"><img src="https://agentmods.dev/badge/skills/cavinhuang/lume/in-app-browser/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cavinhuang/lume/in-app-browser"><img src="https://agentmods.dev/badge/skills/cavinhuang/lume/in-app-browser.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00064 | $0.01884 |
| Opus 5.5 | $0.00026 | $0.00754 |
| Sonnet 5.5 | $0.00013 | $0.00377 |
| Haiku 4.5 | $0.00006 | $0.00188 |
Grade A, and why
In-App 浏览器操作 scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 85 lines — stays where its author put it; the contents beside it link to each section on GitHub.
In-App 浏览器操作手册
通过 mcp__browser__* 工具操作任务专属的内置浏览器标签页。核心循环只有一步:先 snapshot 拿 ref,再按 ref 行动。
标签页管理
| 工具 | 用途 |
|---|---|
list_tabs |
列出本任务拥有的标签页与当前锁定 tab |
open |
新开一个 Agent 标签页并锁定(仅当没有合适 tab 时) |
switch_tab |
切换锁定目标到另一个 Agent 标签页 |
navigate / back / forward / reload |
在锁定的 tab 内导航,返回新 snapshot |
- 任务已有可用 tab 时用
list_tabs找到它继续,不要重复open。 - 跨回合的 tab 交接信息在系统上下文
<browser_continuity>块中,优先复用其中给出的 tab。
观察与交互循环
snapshot:把页面读成紧凑的可访问性树。交互节点带[ref=e12]形式的标记。- 大页面用
next_cursor翻页继续读(截断时结果自带翻页提示);已知目标子树时scope_ref="@e12"只读该子树,否则优先翻页;interactive_only=true只看可交互节点。
- 大页面用
- 行动:把最新 snapshot 的 ref 传给动作工具,ref 写
@e12(带 @)或不带均可:- 点击类:
click/double_click/hover - 输入类:
fill(整体替换)/type(追加)/press(按键,如 Enter、Control+A)/select/check(勾选状态)select的 value 是<option>的 value 属性,不是 snapshot 里看到的显示文本;快照拿不到 value 时用run_script枚举 option 再选
scroll:锚点 ref 必填(取页面上任一元素的 ref,通常为目标区域或根元素),delta_y正值向下滚- 元素不可见/被遮挡/禁用时不要盲试坐标;重新 snapshot 找替代元素或先滚动到可见
- 点击类:
- 每次动作自动返回新 snapshot。只使用最新一次 snapshot 的 ref;旧 ref 一律失效。
视觉核对
screenshot 只用于观察(布局、验证码样式、图表),不能作为交互目标:
- 默认截当前视口;
full_page=true截整页。 annotated=true在截图上标注 ref(需先 snapshot,不能与 full_page 同用)。
确认门
navigate 与提交、发送、删除、授权、上传、填入凭据(fill_secret)、run_script 类动作可能弹出 Lume 用户确认(取决于动作语义,以工具返回为准;open 新开 tab 与下载等待本身不弹),确认在工具调用内同步等待用户裁决。用户拒绝表示否决该路径,换方案而不是换个说法重试同一动作。
上传、下载与对话框
upload:传 ref + 文件数组(本地路径或此前下载返回的 file ref),工具自己等文件选择器,不要拆成脚本模拟。download:点下载控件并等待;超时未完按返回的download_id轮询,完成后返回任务级 file ref。- alert/confirm/prompt 阻塞页面时的处理见错误码表
dialog_blocking行。
保存的密码
list_secrets:列出当前站点 origin 可用的凭据元数据。fill_secret:按 secret_id 填入密码,明文不会进入模型上下文。禁止让用户口述密码或用fill明文填密码。
run_script(兜底)
语义工具表达不了的操作才用 run_script:隔离世界执行 JS 函数体,入参经 arg 传入,必须返回 JSON 可序列化值,超时上限 10s。优先级:语义工具 > run_script。
错误码与恢复
| 错误码 | 含义 | 处理 |
|---|---|---|
stale_target / stale_snapshot_cursor |
页面已导航或用户刚手动操作过页面,旧 snapshot 失效(正常避让) | 重新 snapshot,用新 ref 重试 |
tab_not_found |
锁定 tab 已不存在 | list_tabs 后 open 或 switch_tab |
dialog_blocking |
JS 对话框挡着页面 | 先 dialog 读取,再 handle_dialog 处理后继续 |
element_not_visible / element_occluded / element_disabled / element_readonly / actionability_failed / strict_locator_violation |
元素当前不可交互或定位不唯一 | 重新 snapshot 换可见的替代元素,或先滚动/填写前置字段;不要对同一 ref 连续硬试 |
repeated_action_failure |
同动作同 ref 在同代际连续失败 ≥2 次,已熔断 | 解除路径是成功执行一次 navigate/reload/back/forward/open/switch_tab/handle_dialog(换代际;用户手动导航后同样解锁);在此之前一切点击输入类动作都被拒 |
action_denied |
策略拒绝(如支付、购买) | 停止该意图,交用户处理;不得变相绕过 |
user_declined |
用户在确认弹窗明确拒绝了该动作 | 否决该路径:停止该意图、换方案或询问用户,不要原样或换措辞重试 |
confirmation_unavailable |
确认通道异常(非用户拒绝) | 可重试一次;持续出现说明通道故障,如实告知用户 |
confirmation_timeout |
确认弹窗等待超时,动作未执行(弹窗可能仍开着) | 告知用户完成或关闭弹窗;不要立即重试以免叠出第二个弹窗 |
user_action_required |
CAPTCHA/MFA/硬件密钥步骤 | 停下请用户完成该步;换措辞重试也会被拒(按元素语义识别),不要尝试 |
user_takeover_required |
兼容性错误码:排队动作已失效(当前流程通常不产出) | 重新 snapshot 后最多重试一次;持续失败才询问用户,不要等待不存在的「交回控制」事件 |
navigation_timeout |
页面加载超上限被中断,页面可能仍在后台继续加载 | 先 snapshot 确认实际状态再决定;不要立即重试同一 navigate,持续超时改开新 tab 或如实告知用户 |
browser_unavailable |
浏览器运行时不可用 | 可重试;确认不可用后说明能力降级,才考虑原生 computer-use |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 85 lines · 64 tokens per session scan A 88ffeb171b7f
In-App 浏览器操作 is a skill published in the GitHub repository CavinHuang/lume (3 stars, last pushed 1mo ago), licensed MIT. It adds 64 tokens to every session and 1,884 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
in-app-browser
A guide for using Proma’s built-in controlled web browser to open, view, search, or operate websites.
ha-browser
Hope Agent browser automation — the standard status → tabs → snapshot → act loop, stale-ref recovery rules, and what to do when login / 2FA / captcha / camera-prompt / dialog blocks progress. Load this skill whenever you reach for the browser tool. Trigger on: user asks the agent to open / control / click / scrape /…
guizang-ppt-skill
A skill for creating presentation decks as single HTML files that users can move through horizontally in a browser. It provides templates with WebGL backgrounds, chapter title screens, large data displays, and image grids, in either an editorial or Swiss-style visual direction.
proma-coach
A Chinese-language coach for improving how people use Proma, Agent, Skill, Chat, and project tools.
skill-creator
Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.
automation
A built-in workflow for creating and managing automatic or scheduled tasks. It covers one-time delays, repeated runs, monitoring, reminders, run history, and changing or stopping existing tasks.