Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/frane/vibesurfer/vs-clinpx skills add frane/vibesurfer --skill vs-cligit clone --depth 1 https://github.com/frane/vibesurferWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00081 | $0.05220 |
| Opus 5 | $0.00041 | $0.02610 |
| Sonnet 5 | $0.00016 | $0.01044 |
| Haiku 4.5 | $0.00008 | $0.00522 |
Grade A, and why
vibesurfer scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- One-shot HTTP fetches with no DOM (use `curl`). Copies of this mod
1 near-identical copy found in the catalogue:
- vibesurfer — 100% identical, 0 lines differ
How it starts
The opening of the file, as written. The whole thing — 196 lines — stays where its author put it; the contents beside it link to each section on GitHub.
vibesurfer (binary: vs)
vs is a stateless CLI that talks to a daemon (vs serve, auto-spawned on first call) over a Unix socket. Not installed? npx vibesurfer <args> runs the same binary (downloaded and cached on first use); vs skill install wires it into every detected agent. The daemon owns one long-lived browser engine on the OS main thread and a SQLite store at ~/.vibesurfer/state.db. Every primitive writes one audit row before returning — there's no opt-out, no untracked operation.
Short forms are the default in agent contexts
Every primitive has a short alias. Long forms exist for human-readable documentation; agent invocations should use the shorter form to save tokens. vs o https://... is the canonical shape for vs open https://..., not the other way around. The 19-primitive tables below lead with the short form and show the long form in parens; both work identically.
Frequent flags also have short forms: -S (--session), -j (--json), -F (--full), -s (--since), -n (--limit), -P (--page). The --token flag stays verbose because it's never typed by hand — you paste it from the previous read.
Use this tool when
- You need to drive a real browser to read or interact with a web app (login, scrape behind auth, click through SPA state).
- You need stable refs across snapshots so you can plan a multi-step interaction without scraping coordinates.
- You want persistent auth (cookies + storage) that survives across sessions, encrypted at rest.
- You want every action audited automatically — for replay, debugging, or compliance.
Don't use this tool for
- One-shot HTTP fetches with no DOM (use
curl). - Anything where you'd be parsing the rendered HTML by string matching —
vs_viewalready gives you a typed accessibility tree with stable refs. - Headless screenshots of fixed URLs with no interaction (overkill — though you can; see
vs capture).
The 25 primitives
Wire form is vs_<name> (over the socket); CLI subcommand is <name> with hyphens. Each call returns a state envelope (@<token> success, ! CODE error, ? warning lines before the envelope).
What ships with it
36 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- Cargo.toml 2.1 KB
- README.md 16 KB
- src/active_session.rs 2.3 KB
- src/caller.rs 5.3 KB
- src/client.rs 5.1 KB
- src/commands/dispatch.rs 22 KB
- src/commands/mod.rs 37 KB
- src/commands/render.rs 1.5 KB
- src/flow.rs 5.8 KB
- src/lib.rs 752 B
- src/main.rs 2.4 KB
- src/mcp/content.rs 4.4 KB
- src/mcp/live-panel.html 2.8 KB
- src/mcp/mod.rs 12 KB
- src/mcp/tools.rs 30 KB
- src/paths.rs 1.8 KB
- src/serve.rs 29 KB
- src/skill_install.rs 16 KB
- src/spawn.rs 2.3 KB
- tests/alias_parity.rs 7.1 KB
- tests/auto_spawn.rs 4.6 KB
- tests/e2e_cli.rs 12 KB
- tests/m6_smoke.rs 1.2 KB
- tests/m6/act.rs 20 KB
- tests/m6/auth.rs 9.4 KB
- tests/m6/extract.rs 3.8 KB
- tests/m6/helpers.rs 2.7 KB
- tests/m6/inspect.rs 12 KB
- tests/m6/lifecycle.rs 11 KB
- tests/m6/main.rs 1.1 KB
- tests/m6/memory.rs 2.8 KB
- tests/m6/visual.rs 6.1 KB
- tests/m6/wait.rs 5.6 KB
- tests/m6/webentry.rs 8.9 KB
- tests/support/fixture_server.rs 8.6 KB
- tests/support/mod.rs 9.4 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 196 lines · 81 tokens per session scan A ba363196d9c5
vibesurfer is a skill published in the GitHub repository frane/vibesurfer (15 stars, last pushed 6d ago), licensed Apache-2.0. It adds 81 tokens to every session and 5,220 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
kane-cli
Browser automation + AI test authoring via kane-cli - run browser objectives, generate & refine test scenarios/cases from a description, design requirement-linked test suites from a PRD/spec (assurance), parse NDJSON output, inspect logs, save runnable test.md. Use for any task requiring a real browser (navigate…
yutori-computer-use
Run local Mac desktop tasks with Yutori computer use. Use when the user wants to operate macOS apps, websites in a local browser, or cross-app workflows on the visible desktop.
yutori-browse
Automate browser tasks like form filling, data extraction, or multi-step web workflows. Use when the user needs to interact with websites that require clicking, typing, or navigation.
browseract
Wrapper around the [browser-act][upstream] CLI for stealth-aware browser automation. Works on Windows, macOS, and Linux.
yutori-computer-use
../../../skills/06-computer-use/SKILL.md.
eric-task-master
Install, connect, and use Eric Task Master for durable Playwright browser jobs with persistent or ephemeral Profiles, live fast-auto-human behavior control, task queues, progress health, semantic diagnostics, recovery, artifacts, and composable Task Packs.