Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/hkuds/openspace/http-response-handlingnpx skills add HKUDS/OpenSpace --skill http-response-handlinggit clone --depth 1 https://github.com/HKUDS/OpenSpaceWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00021 | $0.01057 |
| Opus 5 | $0.00010 | $0.00528 |
| Sonnet 5 | $0.00004 | $0.00211 |
| Haiku 4.5 | $0.00002 | $0.00106 |
Grade A, and why
http-response-handling scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
description: Handle websites requiring JavaScript by using curl with browser headers and validating file types. How it starts
The opening of the file, as written. The whole thing — 143 lines — stays where its author put it; the contents beside it link to each section on GitHub.
HTTP Response Handling for JavaScript-Dependent Sites
When to Use This Skill
Use this technique when you need to fetch content from websites that:
- Render content dynamically with JavaScript
- Return placeholder HTML when accessed by non-browser clients
- Deliver different content based on User-Agent headers
Core Technique
Step 1: Fetch Content with Browser-Like Headers
Use curl with a realistic User-Agent header to mimic a real browser:
curl -L -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" -o output.html "https://example.com"
Key flags:
-L— Follow redirects-A— Set User-Agent header to mimic a real browser-o— Save output to file for inspection
Step 2: Detect Placeholder HTML Responses
After fetching, check if you received a placeholder response instead of actual content:
# Check file size (placeholder responses are often very small)
wc -c output.html
# Check for common placeholder indicators
grep -i "javascript" output.html | head -5
grep -i "loading" output.html | head -5
grep -i "noscript" output.html | head -5
Signs of a placeholder response:
- File size is suspiciously small (<5KB for content pages)
- Contains大量 JavaScript but minimal actual content
- Has "loading", "spinner", or "noscript" tags
- Missing expected text/data from the page
Step 3: Validate File Type Before Parsing
Before attempting format-specific parsing, validate the file type:
# Check the file type
file output.html
# Check the actual content type (if you have the headers)
curl -I -A "Mozilla/5.0 ..." "https://example.com" | grep -i content-type
# Inspect first few lines
head -50 output.html
Common checks:
- HTML files: Should start with
<!DOCTYPEor<html - JSON files: Should start with
{or[ - PDF files: Should start with
%PDF - Empty/error pages: May contain error messages or generic HTML
Step 4: Handle Different Scenarios
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 143 lines · 21 tokens per session scan A 7b4457f257bc
http-response-handling is a skill published in the GitHub repository HKUDS/OpenSpace (7,486 stars, last pushed 21d ago), licensed MIT. It adds 21 tokens to every session and 1,057 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
use-agent-browser-for-airi
Test AIRI display-model imports with agent-browser across stage-tamagotchi Electron, stage-web, and stage-pocket mobile web layouts. Use when uploading and verifying contributor-supplied Live2D ZIP, VRM, or MMD ZIP/PMX/PMD files through AIRI's model selector, including onboarding bypass, format-specific import…
opencli-sitemap-author
Use when creating or maintaining OpenCLI site sitemaps: agent-facing navigation, page-state, action, workflow, API-reference, pitfall, and fallback knowledge for a website. Use after browser exploration discovers durable site context, when a sitemap is stale, or when promoting local site knowledge into the repo.
interactive-login
How to complete browser/interactive logins (aws / gh / glab / gcloud). The platform backgrounds the login poller so it survives the human's browser round-trip — and when that does NOT work.
pinchtab-mcp
Use this skill when a task requires browser automation through PinchTab's MCP server connected to a remote browser instance. Covers navigation, element interaction, data extraction, form filling, multi-step flows, and session management via MCP tools.
peekaboo
Capture and automate macOS UI with the Peekaboo CLI.
repro-admin
Reproduce an EmDash admin UI bug. Attach a container, start the demo dev server, drive the admin with agent-browser using the dev-bypass session, and capture the reproduction as screenshots plus a replayable transcript.