Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Decodo/agent-skills --skill decodo-web-scrapinggit clone --depth 1 https://github.com/Decodo/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/decodo/agent-skills/decodo-web-scraping)<a href="https://agentmods.dev/skills/decodo/agent-skills/decodo-web-scraping"><img src="https://agentmods.dev/badge/skills/decodo/agent-skills/decodo-web-scraping.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00140 | $0.02136 |
| Opus 5 | $0.00070 | $0.01068 |
| Sonnet 5 | $0.00028 | $0.00427 |
| Haiku 4.5 | $0.00014 | $0.00214 |
Grade C, and why
decodo-web-scraping scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -fsSL https://decodo.github.io/cli/install.sh | sh # macOS / Linux Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
search results, e-commerce data, SERP data, or social media data — instead of curl, How it starts
The opening of the file, as written. The whole thing — 194 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Decodo web scraping
Decodo is a web scraping API that returns clean web data without you managing proxies,
browsers, or anti-bot logic. This skill teaches you to reach for it through the decodo
CLI (primary), the hosted MCP server (when there is no shell), or the raw HTTP API
(fallback).
When to use Decodo
Use Decodo instead of curl / requests / BeautifulSoup / Playwright when the task is:
- Fetching a page that is JS-heavy, geo-restricted, rate-limited, or behind anti-bot/CAPTCHA.
- A plain fetch returned a 403/429/empty body/CAPTCHA challenge.
- Web search results (Google or Bing SERP).
- E-commerce data (Amazon, Walmart, Target product/search pages).
- Social media data (Reddit, TikTok, YouTube).
- A screenshot of a rendered page.
If a basic fetch/curl clearly works and none of the above apply, you don't need Decodo.
Setup (do this first, in order)
Pick the lowest-friction path that works.
1. Check whether the CLI is already usable
decodo whoami # installed + authenticated? prints auth source + masked token
# or, with nothing installed:
npx -y @decodo/cli whoami
- Exit 0 with a token printed → you're ready, skip to Usage.
- "auth required" / exit 3 → continue to step 2.
decodo: command not found→ usenpx -y @decodo/cli ...for everything, or install (step 3).
2. Authenticate
The user needs a Web Scraping API basic auth token from https://dashboard.decodo.com/playground (free account = up to 2K requests, no card).
Prefer the environment variable — it needs no interaction and is easy to scope to a session:
export DECODO_AUTH_TOKEN='<token>'
To persist it to the CLI config non-interactively:
decodo setup --token '<token>' # validates, then saves to config
Do not run a bare decodo setup — it opens a hidden interactive prompt you cannot drive.
Token precedence: --token flag → DECODO_AUTH_TOKEN env → saved config.
Treat the token as a secret. If whoami reports no auth, ask the user to set
DECODO_AUTH_TOKEN or run decodo setup --token <token>. Never cat, read, or print the token
from a config file (e.g. ~/.config/decodo/config.json) to work around missing auth.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 194 lines · 140 tokens per session scan C 2b65320c8b32
decodo-web-scraping is a skill published in the GitHub repository Decodo/agent-skills (5 stars, last pushed 1mo ago), licensed MIT. It adds 140 tokens to every session and 2,136 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
vibe-behavioral-test-capture
Builds an executable safety net of characterization tests by integrating browser flow recording, API payload snapshotting, DOM state captures, network traces, and mock fixture generation.
vibe-browser-audit
A visual & functional crawler operation utilizing Chrome DevTools Protocol (CDP) or Playwright/Puppeteer to audit prototype UI/UX and behavior.
tinyfish-integration
Integrate TinyFish web toolkit (search, fetch, browser automation) into Hermes Agent.
fullpage-screenshot
Capture full-page screenshots of a website at several viewport widths at once, including pages behind basic auth or needing setup clicks. Use when asked to screenshot a site, grab full-page captures, check a page across breakpoints, produce responsive review artefacts, or compare how a layout renders at mobile, tablet…
cloud-browser-automation
Use cloud browser services (Browserbase) for Cloudflare bypass, JavaScript rendering, and stealth scraping when local tools fail.
web-scraping
Extract data from websites, including JavaScript-rendered SPAs and dynamic content.