Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/jackwener/opencli/opencli-adapter-authornpx skills add jackwener/OpenCLI --skill opencli-adapter-authorgit clone --depth 1 https://github.com/jackwener/OpenCLIWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00088 | $0.05328 |
| Opus 5 | $0.00044 | $0.02664 |
| Sonnet 5 | $0.00018 | $0.01066 |
| Haiku 4.5 | $0.00009 | $0.00533 |
Grade A, and why
opencli-adapter-author scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- opencli-adapter-author — 91% identical, 47 lines differ
How it starts
The opening of the file, as written. The whole thing — 282 lines — stays where its author put it; the contents beside it link to each section on GitHub.
opencli-adapter-author
你是要给一个站点写 adapter 的 agent。这份 skill 目标：简单站点争取 30 分钟内从零到通过 opencli browser verify；复杂、私有协议或写操作站点以证据完整和安全为先，不为了时限猜接口。
全程用现有工具：opencli browser * / opencli doctor / opencli browser init / opencli browser verify。没有新命令。
调试浏览器型 adapter 时，优先直接带上 --trace on --keep-tab true --window foreground。--trace on 每轮都落 trace artifact，summary.md 是失败/成功复盘入口；--keep-tab true --window foreground 让 tab lease 保留且浏览器窗口在前台，方便核对最终页面状态。
前置：看你落在哪
先拿 coverage-matrix.md 快速自测。三个问题：
- 数据在浏览器里看得到吗？（否 → 先解决鉴权）
- 数据是 HTTP/JSON/HTML 吗？（否 → 不在 skill 范围）
- 需要实时推送吗？（是 → 找同数据 HTTP 接口；没有就放弃）
三个都 yes 继续。
顶层决策树
先定 strategy，再写 adapter。 每次进入 Step 3/4 后、写代码前，必须产出一段 strategy note。没有这段 note，不要开始写 clis/<site>/<name>.js。
核心判断不是 "API 比 DOM 高级"，而是 数据源有没有外部契约。实测维护成本显示：公开/官方接口最稳；UI/DOM 语义通常也有用户可见契约；站内未文档化 XHR/GraphQL/signature endpoint 最容易漂。不要为了 "API-first" 把稳定的 UI/DOM 实现盲目迁到无契约内部接口。
Strategy: PUBLIC_API | COOKIE_API | PAGE_FETCH | INTERCEPT | DOM_STATE | UI_SELECTOR
Contract: stable | visible-ui | internal-unstable
Evidence:
- observed request/state: <endpoint / state global / UI-only signal>
- auth source: <none / browser cookie / csrf from meta / localStorage / page runtime>
- replay result: <status + content-type + non-empty sample shape>
If Strategy is PAGE_FETCH or INTERCEPT:
- why PUBLIC_API / COOKIE_API are unavailable:
- why UI_SELECTOR / DOM_STATE are not safer:
- why the maintenance cost is acceptable:
Strategy classes:
| Strategy | 契约级别 | 用在什么时候 | 证据要求 |
|---|---|---|---|
PUBLIC_API |
stable | 不需要登录，Node-side fetch 直接拿到目标数据 |
200 + JSON/HTML 含目标数据，不是埋点/广告 |
COOKIE_API |
stable | Node-side fetch + page.getCookies() / header helper 能拿数据 |
cookie/CSRF 来源清楚，replay 非空 |
UI_SELECTOR |
visible-ui | publish/upload/click/表单，或页面语义比内部接口更稳 | selector 有语义锚点；错误路径是 typed error |
DOM_STATE |
visible-ui | 数据在 hydration state / bootstrap JSON / SSR HTML 里 | state key / script JSON / HTML 结构明确 |
PAGE_FETCH |
internal-unstable | 只能在页面上下文 fetch 才能复用 same-origin/session/runtime |
opencli browser eval fetch(...) 非空；必须解释为什么避不开内部接口 |
INTERCEPT |
internal-unstable | 请求签名复杂，但页面自己能自然发出请求 | 触发 UI 后能截到目标 response；必须解释为什么 UI/DOM 不够 |
What ships with it
18 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/adapter-template.md 21 KB
- references/api-discovery.md 16 KB
- references/coverage-matrix.md 5.5 KB
- references/deep-recon.md 10 KB
- references/field-conventions.md 5.2 KB
- references/field-decode-playbook.md 7.0 KB
- references/jsdom-fixture-pattern.md 7.8 KB
- references/output-design.md 4.7 KB
- references/site-memory.md 11 KB
- references/site-memory/bilibili.md 3.6 KB
- references/site-memory/eastmoney.md 3.8 KB
- references/site-memory/gmail.md 2.8 KB
- references/site-memory/tonghuashun.md 2.4 KB
- references/site-memory/xueqiu.md 2.8 KB
- references/site-recon.md 5.3 KB
- references/strategy-selection.md 8.7 KB
- references/success-rate-pitfalls.md 9.4 KB
- references/typed-errors.md 13 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 282 lines · 88 tokens per session scan A f1acca32328f
opencli-adapter-author is a skill published in the GitHub repository jackwener/OpenCLI (28,850 stars, last pushed 3d ago), licensed Apache-2.0. It adds 88 tokens to every session and 5,328 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
browser-use
Direct browser control via CDP for web interaction: automation, scraping, testing, screenshots, and site/app work.
remote-browser
Controls an isolated Browser Use Cloud browser from a sandboxed machine with the current Browser Use CLI.
cloud
Documentation reference for using Browser Use Cloud — the hosted API and SDK for browser automation. Use this skill whenever the user needs help with the Cloud REST API (v2, v3, or v4), browser-use-sdk (Python or TypeScript), X-Browser-Use-API-Key authentication, cloud sessions, browser profiles, profile sync, CDP…
open-source
Documentation reference for writing Python code using the browser-use open-source library. Use this skill whenever the user needs help with Agent, Browser, or Tools configuration, is writing code that imports from browseruse, asks about @sandbox deployment, supported LLM models, Actor API, custom tools, lifecycle…
qa
QA-test a website or web app and return a 1-5 quality score (5 = flawless, 1 = broken) with evidence. Use when the user wants to test, QA, evaluate, score, or "check how good" a site, page, flow, or app — including a local dev server (e.g. "qa test localhost:5173", "does the checkout work?", "rate this landing page").…
interceptor-research
Deep web-research methodology for the interceptor browser surface — investigate a topic the way researchers, intelligence analysts, investigative journalists, private investigators, and OSINT operators do, not 'read 3 links and summarize.' Use when the task is research, deep research, investigate, go deeper, be…