Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add cosmicstack-labs/mercury-agent-skills --skill amazon-assistantgit clone --depth 1 https://github.com/cosmicstack-labs/mercury-agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cosmicstack-labs/mercury-agent-skills/amazon-assistant)<a href="https://agentmods.dev/skills/cosmicstack-labs/mercury-agent-skills/amazon-assistant"><img src="https://agentmods.dev/badge/skills/cosmicstack-labs/mercury-agent-skills/amazon-assistant/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cosmicstack-labs/mercury-agent-skills/amazon-assistant"><img src="https://agentmods.dev/badge/skills/cosmicstack-labs/mercury-agent-skills/amazon-assistant.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high YARA Match · line 32 YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).Fix: Remove the malware payload or compromised file entirely. Investigate how it entered the skill and audit all other artifacts for additional indicators of compromise.
- medium Privilege Escalation · line 201 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 403 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 415 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00077 | $0.09618 |
| Opus 5 | $0.00039 | $0.04809 |
| Sonnet 5 | $0.00015 | $0.01924 |
| Haiku 4.5 | $0.00008 | $0.00962 |
Grade B, and why
amazon-assistant scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
Cookies pasted via this path contain identical auth power to those captured by Path A. Same `chmod 600`, same "never share" rule. The script never echoes the pasted content back to stdout/stderr. How it starts
The opening of the file, as written. The whole thing — 872 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Amazon Assistant 🛒
⚠ Terms-of-Service notice. Amazon's Conditions of Use prohibit automated access, scraping, and bots. This skill drives a real browser session with the user's own cookies — Amazon may still treat that as a ToS violation, throw CAPTCHAs, or in repeated cases suspend the account. Use it on your own account, at a human pace, and accept the risk. The skill never places orders unattended — final submission is always a human click.
Core Principle
Amazon has no public consumer API for cart/checkout/order operations. The only viable automation path is cookie-based session reuse with a headed (visible) browser:
- Phase 1 — Setup (one-time per device/account): open a visible Chromium, user logs in manually, cookies are captured.
- Phase 2 — Operate (reusable): load cookies, run scripted operations (search, cart, orders, deals, insights).
- Phase 3 — Checkout (always human-confirmed): the script builds the cart and opens the checkout page. The user clicks "Place Order".
Why headed and not headless: Amazon's anti-bot stack (PerimeterX-style fingerprinting) detects navigator.webdriver, missing WebGL, headless Chrome user-agents, etc. A visible Chromium with a real cookie set passes the bar far more reliably and tends to avoid CAPTCHAs. The script does support --headless for the read-only operations (search, product, deals) where the risk is lower.
When To Use This Skill
Setup-state precedence (agent MUST follow this order)
Every invocation of any cart/order/checkout/insights command must first verify auth state. The agent's decision tree:
1. Does ~/.mercury/amazon/cookies.json exist AND `amazon.py whoami` print a name?
YES → proceed with the user's request.
NO → go to step 2.
2. Offer Path A (auto-capture) FIRST. Sample message:
"You're not logged in to Amazon yet. I'll open a Chromium window —
just log in normally and I'll save the session automatically and
close the window. Ready?"
If the user agrees → run `amazon.py setup` → back to step 1.
3. Only if Path A fails or is impossible (no display, sandbox blocked,
user explicitly refuses) → offer Path B (EditThisCookie paste).
Run `amazon.py setup --paste`.
4. After cookies are saved, re-run `whoami` to confirm before doing the
user's original request.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 872 lines · 77 tokens per session scan B 8467ca0a0d55
amazon-assistant is a skill published in the GitHub repository cosmicstack-labs/mercury-agent-skills (471 stars, last pushed 17d ago), licensed MIT. It adds 77 tokens to every session and 9,618 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
dingtalk_channel_connect
Use a headed browser to automatically complete DingTalk channel integration for QwenPaw. Applicable when the user mentions DingTalk, developer console, Client ID, Client Secret, bot, Stream mode, binding or configuring a channel. Supports pausing when a login page is detected and resuming after the user logs in.
browser
Drive a live browser with async Python against QwenPaw's builtin Browser SDK. The full reference is below; re-load this browser skill after context compaction.
webmcp
Open a user-provided URL in the host's built-in browser and use the page's MCP or WebMCP tools before browser UI automation for app communication or edits.
dev-browser
Browser automation with persistent named pages via the dev-browser CLI. Use when users ask to navigate websites, fill forms, take screenshots, extract web data, test web apps, log into sites, or automate browser workflows. Trigger phrases include "go to [url]", "click on", "fill out the form", "take a screenshot"…
an
Open and operate Agent-Native workspace apps through Dispatch MCP, with inline app surfaces, browser-session authentication, and current screen state.
amazon-bestseller-listing
Amazon Best Sellers listing scraper: extract product cards from any Amazon Best Sellers (zgbs) or /gp/bestsellers/ category page — returns rank (position on chart), asin, title, url, image, imageAlt, price, stars, reviewCount, ratingRaw per item, plus category metadata (categoryName, categoryFullName, categoryUrl) and…