Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mengrru/Spherse --skill spherse-use-ui-sdkgit clone --depth 1 https://github.com/mengrru/SpherseWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mengrru/spherse/spherse-use-ui-sdk)<a href="https://agentmods.dev/skills/mengrru/spherse/spherse-use-ui-sdk"><img src="https://agentmods.dev/badge/skills/mengrru/spherse/spherse-use-ui-sdk/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mengrru/spherse/spherse-use-ui-sdk"><img src="https://agentmods.dev/badge/skills/mengrru/spherse/spherse-use-ui-sdk.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00092 | $0.05710 |
| Opus 5 | $0.00046 | $0.02855 |
| Sonnet 5 | $0.00018 | $0.01142 |
| Haiku 4.5 | $0.00009 | $0.00571 |
Grade A, and why
spherse-use-ui-sdk scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 446 lines — stays where its author put it; the contents beside it link to each section on GitHub.
UI SDK — window.spherse
Spherse 中的 HTML 内容（欢迎页、Content Browser 预览、聊天 HtmlCard）都在 iframe 中展示。App 会自动向每个 HTML 注入一个零依赖的 SDK 脚本，暴露 window.spherse（另有别名 window.Spherse，其它大小写不可用）。你不需要手写 postMessage、不需要内联 Promise wrapper、不需要引入任何脚本标签 —— 直接用即可。
快速上手
<button onclick="spherse.openFile('world/characters.md')">打开角色档案</button>
<button onclick="startWriting()">开始写作</button>
<script>
function startWriting() {
spherse.createSession({ agentId: "writer", message: "开始新的写作会话" });
}
</script>
SDK 已由 App 注入，不要再自己写 <script> 加载它，也不要复制 spherseCall 之类的 wrapper —— 那些都已内置。
API 总览
window.spherse 提供以下能力：
| 类别 | 方法 | 说明 |
|---|---|---|
| 触发型（fire-and-forget） | openSession / openFile / openExternalLink / floatSession / unfloatSession / floatContent / unfloatContent / emitAgentTriggerEvent / toast |
单向触发，无返回值 |
| 请求型（Promise） | createSession(params) → Promise<{ sessionId }> |
创建会话，返回新会话 ID |
| 请求型（Promise） | sendMessage(params) → Promise |
等待发送结果 |
| 请求型（Promise） | data.get / data.set / data.delete / data.keys / data.entries / data.mutate |
key-value 持久化 + manifest 结构性变更 |
| 请求型（Promise） | api.call(op, args) 及 api.* 命名方法 |
只读查询项目信息（agents / sessions / content / fileTree） |
| 事件型 | events.on("file:update", filter, handler) |
订阅指定项目文件的变化信号 |
| 运行时 | spherse.runtime（同步读）/ spherse.getRuntime()（Promise） |
获取当前会话上下文（仅 HtmlCard 有值） |
所有请求型方法都返回 Promise，内部已处理 requestId 匹配与 10 秒超时，失败时 reject。
运行时上下文（聊天 HtmlCard 专属）
当 HTML 作为聊天 HtmlCard 渲染时，spherse.runtime 携带当前会话信息；Welcome Page 与 Content Browser 预览中为 null。
- 交互式卡片（用户点击才触发）：直接读
spherse.runtime - 加载即使用：用
await spherse.getRuntime()（内部已处理竞态，无需自己注册 message 监听）
const rt = await spherse.getRuntime();
// rt.sessionId / rt.agentId / rt.projectId
await spherse.sendMessage({ sessionId: rt.sessionId, message: "继续分析" });
触发型 Action
spherse.openFile(path) / spherse.openFile(params)
在 Content Browser 中打开项目文件。path 可传字符串或对象 { path, float }。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 446 lines · 92 tokens per session scan A dd6fbceb35e1
spherse-use-ui-sdk is a skill published in the GitHub repository mengrru/Spherse (72 stars, last pushed 5d ago), licensed MIT. It adds 92 tokens to every session and 5,710 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
web-design
Penguin visual language for generated web pages and app UIs — GitHub-style simplicity with a single blue accent, light and pure-black dark themes, design tokens, component and chat-interface recipes, plus an opt-in warm paper editorial theme.
ui-secure-review
Review frontend and UI changes for concrete security risks such as XSS, unsafe URL handling, token leakage, missing origin checks, and client-side authorization gaps. Use when users ask for a UI code review focused on safety and reliability.
aster-ui-demo
How to demo UI work the way Claude does it, never with throwaway HTML mockups. Build the change in the real webview, verify it in the browser harness, open the live dev server for the user to click through, and run the real test suites. Use when the user asks for a demo, a preview, or "let me see" any UI change in the…
ui-resilient-accessibility
Build and review UI components for robust accessibility and runtime resilience, including semantic structure, keyboard support, loading and error states, retry flows, and predictable async behavior.
ui-safe-form-patterns
Implement or refactor UI forms with defense-in-depth validation, safe input handling, reliable submission behavior, and privacy-aware error handling. Use when building login, registration, profile, payment, admin, or file-upload forms.
deepseek-harness
Use when building AI agent applications with a plugin-based architecture — Web UI, CLI, Python SDK, Cordis plugin system, multi-model orchestration. DeepSeek Harness (dsh): open-source agent harness by DeepSeek AI where everything is a plugin, powered by Cordis for spatiotemporal composability.