Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add IceWhaleTech/ZimaOS-Blue --skill web_querygit clone --depth 1 https://github.com/IceWhaleTech/ZimaOS-BlueWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/icewhaletech/zimaos-blue/web_query)<a href="https://agentmods.dev/skills/icewhaletech/zimaos-blue/web_query"><img src="https://agentmods.dev/badge/skills/icewhaletech/zimaos-blue/web_query.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00059 | $0.00835 |
| Opus 5 | $0.00030 | $0.00417 |
| Sonnet 5 | $0.00012 | $0.00167 |
| Haiku 4.5 | $0.00006 | $0.00084 |
Grade A, and why
web_query scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 74 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Web Search Skill
Setup
No external dependencies required. Uses built-in web search capability.
Task Routing
| User Intent | Action |
|---|---|
| Need relevant links/sources quickly and do not yet have the right URL | blue web_query input=... |
| Need official docs/reference pages | blue web_query with precise query terms |
| Already have a concrete public URL and only need page content | blue web_query input="https://..." |
| Already have a concrete URL that needs login state but only need readable content | Prefer authenticated read/fetch with Cookie, Authorization, or browser_target_id before using full browser automation |
| Need page interaction/login/JS rendering | Search first, then switch to browser |
Command Usage
blue web_query input="ZimaOS Blue release notes"
blue web_query input="OpenAI Responses API function calling" max_results=8
blue web_query input="container sandbox security best practices" max_results=10
blue web_query input="https://platform.openai.com/docs/api-reference/responses"
Parameters:
input(required; search query or public URL)max_results(optional, default 10, max 20)max_chars(optional, only for page reads)depth(optional,quick,standard,deep)
Error Handling
| Error | Resolution |
|---|---|
input is required |
Provide a non-empty search query or URL |
| Page requires login or interaction | Reuse existing Cookie, Authorization, or browser_target_id first; if the site still needs a live session, switch to browser |
Notes
web_queryis the canonical public web skill.- Legacy
web_search,web_fetch, andweb_readnames are compatibility aliases and should not be used as the primary route in new prompts or harness cases. - If
web_queryreports login wall, challenge, or browser-required warnings, prefer an authenticated read/fetch path with existingCookie,Authorization, orbrowser_target_idbefore escalating tobrowser. - When the login state already exists in Chrome and the site needs a live authenticated browser, prefer
browserwith relay/local Chrome (Chrome replay) instead of starting from a fresh anonymous tab. - Blue also uses an internal recent multi-site retrieval profile inside the web layer for Research requests such as
what are people saying in the last 30 days/最近30天大家怎么说. - That recent profile is native to
web_queryinternals, not a separate public mode or command. - The current native source mix includes public web, Reddit, Hacker News, GitHub, Polymarket, X, TikTok, Instagram, and Bluesky. Known YouTube URLs can be added as enrichment when they are already present in the request.
- For X, TikTok, Instagram, and Bluesky, Blue currently relies on public-page discovery plus browser-assisted reading rather than a separate public platform command.
- If the user only wants a few links or one readable page, keep using ordinary
web_query input=...calls rather than trying to surface the internal recent profile directly.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 74 lines · 59 tokens per session scan A c558dfb92e77
web_query is a skill published in the GitHub repository IceWhaleTech/ZimaOS-Blue (25 stars, last pushed 4mo ago), licensed MIT. It adds 59 tokens to every session and 835 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
credential-setup-with-computer-use
Guides n8n credential setup through Computer Use browser tools. Use when a user needs OAuth apps, API keys, client IDs, client secrets, or other credential values from an external service console.
defuddle
Extract clean markdown content from web pages using Defuddle CLI, removing clutter and navigation to save tokens. Use instead of WebFetch when the user provides a URL to read or analyze, for online documentation, articles, blog posts, or any standard web page. Do NOT use for URLs ending in .md — those are already…
browser-harness-skill
Drive the user's real Chrome over raw CDP by writing Python against browser-harness helpers - screenshot, coordinate clicks, JS evaluation, form fill, tabs. For tasks needing full freedom or the user's own logins.
browser-skill
Interactive browser automation - navigate, click, type, fill forms, take screenshots, get accessibility snapshots. Supports system Chrome/Edge via auto-detection.
nearby-places-skill
Search for nearby places like restaurants, cafes, stores, and services using Google Places API. Find places by type and location.
unbrowse
One-call web access for agents with cache-first API replay and browser capture on misses. Unbrowse passively learns first-party route DAGs while browsing, independently validates replay, and keeps remote sharing consented and fail-closed. Prefer it over WebFetch, curl, and browser loops.