Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add DDDFXYqiming/Agent_Extensions --skill generic-agent-code-rungit clone --depth 1 https://github.com/DDDFXYqiming/Agent_ExtensionsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dddfxyqiming/agent_extensions/generic-agent-code-run)<a href="https://agentmods.dev/skills/dddfxyqiming/agent_extensions/generic-agent-code-run"><img src="https://agentmods.dev/badge/skills/dddfxyqiming/agent_extensions/generic-agent-code-run/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dddfxyqiming/agent_extensions/generic-agent-code-run"><img src="https://agentmods.dev/badge/skills/dddfxyqiming/agent_extensions/generic-agent-code-run.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00075 | $0.01403 |
| Opus 5.5 | $0.00030 | $0.00561 |
| Sonnet 5.5 | $0.00015 | $0.00281 |
| Haiku 4.5 | $0.00007 | $0.00140 |
Grade C, and why
generic-agent-code-run scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
- 删除文件或目录；不跑 `rm -rf`、`Remove-Item -Recurse -Force` 及等价命令。 How it starts
The opening of the file, as written. The whole thing — 128 lines — stays where its author put it; the contents beside it link to each section on GitHub.
GenericAgent Code_Run
用 GenericAgent 的模式操作 Windows 原生桌面应用与真实浏览器会话：极少的固定工具、一条通用的 code_run 执行通道、本地能力库，外加严格的「观察-执行-校验」闭环。
核心思路不是背下一大堆固定工具，而是：针对当前任务生成一小段专用 Python，执行它，拿回 JSON 证据，再从已验证的状态决定下一步动作。
何时使用
- Windows 原生应用操控：窗口枚举、激活、截图、OCR、UIA、点击、输入。
- 带已有登录态的真实浏览器操控：TMWebDriver、Chrome 扩展 CDP 桥、DOM/JS/CDP 操作。
- 需要临时组合本地 Python 能力，而不是依赖预先声明好的 GUI 工具集。
- 每一次副作用之后都必须可靠地校验结果。
不要照搬 GenericAgent 的完整 agent loop、LLM 客户端或记忆系统——这些层次由宿主框架负责。
核心机制
observe -> generate minimal code_run Python -> execute -> return JSON evidence -> verify -> next action
一个 code_run 代码块只导入当前这一步真正需要的模块：
import json
# optional imports as needed:
# import win32gui, win32api, win32con
# from PIL import ImageGrab
# import pyperclip, uiautomation
# from TMWebDriver import TMWebDriver
result = {"ok": False, "action": "", "evidence": {}, "error": None}
# perform one minimal action or one observation
print(json.dumps(result, ensure_ascii=False, indent=2))
一律返回 JSON。
桌面操控流程
- 观察：用
win32gui.EnumWindows枚举窗口，用PIL.ImageGrab.grab截图，UIA/OCR 只在需要时看。 - 锁定目标：产生任何副作用前，先核对标题、hwnd、class、进程和窗口矩形区域。
- 执行：使用尽可能小的 Win32/UIA/剪贴板/鼠标/键盘动作。
- 校验：动作之后用截图/OCR/UIA/窗口状态确认结果。
- 只报告已验证的结论。
细则见 references/windows-control.md、references/code-run-core.md。
浏览器操控流程
优先级顺序：
DOM/Runtime.evaluate -> CDP Input.dispatchMouseEvent -> physical mouse click
需要真实登录态时，复用已有浏览器会话或持久化上下文。校验手段：URL、标题、DOM 文本、截图或接口响应。
细则见 references/browser-control.md，探针脚本：scripts/browser_cdp_probe.py。
安全规则
绝不做：
- 删除文件或目录；不跑
rm -rf、Remove-Item -Recurse -Force及等价命令。 - 批量杀进程，例如杀掉所有
python.exe。 - 读取或输出凭据、API Key、Cookie 或任何机密。
- 未经明确确认就提交支付或敏感个人信息。
- 在没有观察证据的情况下点击凭猜测得出的坐标。
- 未做校验就宣称成功。
必须做：
- 副作用之前先确认目标窗口。
- 每段 code_run 片段保持简短。
- 返回带证据的 JSON。
- 每次副作用之后都校验。
- 如实报告失败。
完整清单见 references/safety-rules.md。
环境
设计上要求可移植——绝不把本地 GenericAgent 检出路径写死。
$env:GENERIC_AGENT_ROOT='D:\path\to\GenericAgent'
$env:GENERIC_AGENT_PYTHON='D:\path\to\GenericAgent\.venv\Scripts\python.exe'
What ships with it
15 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/browser-control.md 1.4 KB
- references/code-run-core.md 1.6 KB
- references/environment.md 1.7 KB
- references/safety-rules.md 1018 B
- references/session-lessons.md 2.0 KB
- references/source-map.md 1.1 KB
- references/windows-control.md 1.8 KB
- scripts/browser_cdp_probe.py 1.6 KB runs code
- scripts/desktop_probe.py 2.5 KB runs code
- scripts/ga_env.py 3.8 KB runs code
- scripts/screenshot_ocr.py 3.6 KB runs code
- scripts/window_ops.py 1.9 KB runs code
- templates/browser-task-checklist.md 390 B
- templates/code-run-snippet.py 753 B runs code
- templates/desktop-task-checklist.md 464 B
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · -205 lines · +30 tokens per session 6e625250f9be
- 1mo ago First seen · 333 lines · 45 tokens per session scan C c3553d0ce5b7
generic-agent-code-run is a skill published in the GitHub repository DDDFXYqiming/Agent_Extensions (6 stars, last pushed 6d ago), licensed MIT. It adds 75 tokens to every session and 1,403 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it C with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
python-programming-expert
Expert-level skill for Python programming (Python 3.13/3.14+). Covers type safety, generic syntax (PEP 695), async/await TaskGroups, FastAPI 0.115+, Pydantic v2, uv package manager, Ruff, and pytest in English and Indonesian.
developing-kafka-python-client
Use when the user wants to build a Python Kafka producer or consumer, add Schema Registry to existing Python code, migrate from raw JSON to schema-backed serialization, or scaffold a confluent-kafka-python project for Confluent Cloud, local Docker, or WarpStream. Also use when user wants to optimize Python Kafka…
upstash-box-py
Work with the upstash-box Python SDK for sandboxed cloud containers with AI agents, shell, filesystem, git, cron schedules, snapshots, and a headless browser. Use when building with Upstash Box in Python, creating a sandbox or isolated environment to run untrusted or agent-generated code, running AI coding agents in…
django
Use when building Django applications. Covers ORM query performance, model design, migrations, Django REST Framework, security defaults, and testing. Trigger on "django view is slow", "too many queries from the orm", "add a drf endpoint", "migration on a big table". Do not use for API contract decisions independent of…
fastapi
Use when building APIs with FastAPI. Covers dependency injection, Pydantic v2 validation, async database access, authentication, background tasks, and testing. Trigger on "fastapi endpoint is slow under load", "set up depends for the db session", "pydantic v2 validation error", "test my fastapi app". Do not use for…
create-pubsub-python
Creates a Dapr pub/sub app in Python with FastAPI (publisher, subscriber or both) and declarative, programmatic or streaming subscriptions. Use for "create a pub/sub app in Python" or "build a FastAPI publisher and subscriber with Dapr". For an existing app use add-pubsub-python.