A browser-session recovery skill for WaterlooWorks, the University of Waterloo's job and co-op portal. It restores an existing Chrome session when the site shows certain logged-out pages.

It helps reopen a job-search or application page after recovering the session, without inspecting passwords, cookies, or browser storage.

It avoids asking the user to log in again when the saved browser session can be refreshed through the site's normal login path.

ww-login — Skill for Codex by jerryzhang1011

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add jerryzhang1011/waterlooworks-application-plugins --skill ww-login

Clone the repo

git clone --depth 1 https://github.com/jerryzhang1011/waterlooworks-application-plugins

Made for: Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/jerryzhang1011/waterlooworks-application-plugins/ww-login/github.svg)](https://agentmods.dev/skills/jerryzhang1011/waterlooworks-application-plugins/ww-login)

Your own site

<a href="https://agentmods.dev/skills/jerryzhang1011/waterlooworks-application-plugins/ww-login"><img src="https://agentmods.dev/badge/skills/jerryzhang1011/waterlooworks-application-plugins/ww-login/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/jerryzhang1011/waterlooworks-application-plugins/ww-login"><img src="https://agentmods.dev/badge/skills/jerryzhang1011/waterlooworks-application-plugins/ww-login.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 90 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 777 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00090	$0.00777
Opus 5	$0.00045	$0.00388
Sonnet 5	$0.00018	$0.00155
Haiku 4.5	$0.00009	$0.00078

Measured 10d ago against content hash 7aca4f44470e, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-10, from the pricing page.

Security

Grade A, and why

ww-login scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/waterlooworks-jobs-codex/skills/ww-login/SKILL.md · 46 lines

How it starts

The opening of the file, as written. The whole thing — 46 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Overview

Restore the user's existing WaterlooWorks session in Chrome without handling credentials. This skill follows the recorded refresh path: notLoggedIn.htm -> Log Into WaterlooWorks -> WaterlooWorks home -> Students/Alumni/Staff -> authenticated MyAccount dashboard.

Use this only with the user's existing Chrome profile/session. Do not inspect cookies, local storage, saved passwords, or browser profile internals.

Inputs

application_tab or jobs_tab: a Chrome-controlled WaterlooWorks tab that may be logged out.
return_url: optional WaterlooWorks URL to reopen after refresh. Default to https://waterlooworks.uwaterloo.ca/myAccount/co-op/full/jobs.htm.

Recoverable States

Treat these as recoverable without user help:

URL contains waterlooworks.uwaterloo.ca/notLoggedIn.htm.
Page title or heading contains WaterlooWorks - Not Logged In.
Page shows a Log Into WaterlooWorks link.
Page is https://waterlooworks.uwaterloo.ca/home.htm and shows Students/Alumni/Staff.
URL is https://waterlooworks.uwaterloo.ca/waterloo.htm?action=login and the tab is redirecting or already titled University of Waterloo - MyAccount - Dashboard.

Stop and ask the user to complete login manually when the page shows any username/password field, Microsoft/WatIAM/SSO sign-in form, Duo/MFA approval, CAPTCHA, browser permission prompt, or explicit authentication error. After the user says they are done, run this skill again and verify the session.

Workflow

Claim or continue the relevant WaterlooWorks Chrome tab. If no tab is supplied, open return_url in the user's existing Chrome profile.
Inspect the visible page title, URL, and accessible link/button labels.
If already authenticated under /myAccount/, return success. If the tab shows the MyAccount dashboard after a redirect, navigate to return_url and verify it loads.
If on notLoggedIn.htm or a WaterlooWorks - Not Logged In page, click the link named Log Into WaterlooWorks. Wait for navigation to the WaterlooWorks home page.
If on the WaterlooWorks home page, click the Students/Alumni/Staff link. Wait for the redirect to finish.
If the tab reaches University of Waterloo - MyAccount - Dashboard or any authenticated /myAccount/ page, navigate to return_url if needed.
Verify success by checking that the final page URL is under waterlooworks.uwaterloo.ca/myAccount/ and does not show notLoggedIn.htm, credential fields, or a logged-out heading.

Read the full file on GitHub · 46 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

agents/openai.yaml 196 B

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

10d ago First seen · 46 lines · 90 tokens per session scan A 7aca4f44470e

Subscribe to this mod's changes

ww-login is a skill published in the GitHub repository jerryzhang1011/waterlooworks-application-plugins (1 stars, last pushed 2mo ago), licensed MIT. It adds 90 tokens to every session and 777 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Browser automation Claude Code claude-code-plugin co-op codex job-search students

solve-captcha

Solve a CAPTCHA on the current browser tab - free checkbox/text paths first, then a configured token service for image challenges. Returns solved or unsolved for the caller to fall back.

suxrobGM/jobpilot · 40 tokens

recheck-statuses

Use when the user wants to verify which Job Search HQ vacancies are still live vs closed / deleted. Triggers: /recheck-statuses, "check dead listings", "clean closed roles", "are these still open?", "refresh statuses". Walks data/vacancies.json, opens each URL (webfetch first, Chrome fallback for auth-gated), and…

Miracle-Aligner/job-search-hq · 121 tokens

broken-link-checker

Scans a website to find broken links (404s, 500s). Crawls internal pages, identifies broken outbound links, and reports source pages for easy fixing. Use this when the user asks to "check for broken links", "find 404s", "audit my links", or "is my site healthy".

nowork-studio/notfair-plugin · 70 tokens

test-site

Tests a deployed, activated Power Pages site at runtime using browser-based navigation, page crawling, and API request verification via Playwright. Use when the user wants to test, verify, or smoke-test their deployed site.

microsoft/power-platform-skills · 46 tokens

preview-screens

Use when the user wants to preview generated screens in a browser without starting Metro / a simulator — for example after /create-mobile-app finishes or after /edit-app regenerates a screen.

microsoft/power-platform-skills · 41 tokens

qa

Browser-based QA verification. Launches a real browser, navigates the app, clicks buttons, fills forms, and tests user flows. Works as a standalone skill or as a phase end condition in campaigns. Requires Playwright (optional dependency, graceful skip if not installed).

SethGammon/Citadel · 56 tokens