Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mengrru/Spherse --skill spherse-write-htmlgit clone --depth 1 https://github.com/mengrru/SpherseWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mengrru/spherse/spherse-write-html)<a href="https://agentmods.dev/skills/mengrru/spherse/spherse-write-html"><img src="https://agentmods.dev/badge/skills/mengrru/spherse/spherse-write-html/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mengrru/spherse/spherse-write-html"><img src="https://agentmods.dev/badge/skills/mengrru/spherse/spherse-write-html.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00123 | $0.04329 |
| Opus 5 | $0.00062 | $0.02165 |
| Sonnet 5 | $0.00025 | $0.00866 |
| Haiku 4.5 | $0.00012 | $0.00433 |
Grade A, and why
spherse-write-html scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 267 lines — stays where its author put it; the contents beside it link to each section on GitHub.
编写 HTML 页面 — 数据读写与 App 能力调用
本 skill 只规范 HTML 页面如何读取/写入数据、如何调用 App 内能力，不约束页面视觉风格、布局或代码风格。
强制：声明字符编码
所有 HTML 页面必须在 <head> 中添加 <meta charset="UTF-8">，且尽量靠近 <head> 起始位置，避免中文乱码。
<!DOCTYPE html>
<html lang="zh-CN">
<head>
<meta charset="UTF-8">
<title>页面标题</title>
</head>
<body>
<!-- ... -->
</body>
</html>
强制：不要禁止页面滚动
HtmlCard 在固定高度的 iframe 中渲染（默认 400px，上限 600px）。当页面内容超出卡片高度时，必须能滚动查看全部内容——切勿设置 body { overflow: hidden } 或 html { overflow: hidden }，否则超出部分被裁剪、无法滚动，用户看不到完整内容。
/* ❌ 错误：卡片内内容会被裁剪，无滚动条 */
body { overflow: hidden; }
/* ✅ 正确：保持默认（visible）或显式允许滚动 */
body { overflow-y: auto; }
即便不加
overflow:hidden，App 也会在渲染时强制注入html,body{overflow-y:auto!important}作为兜底；但请勿依赖兜底，页面自身就应保持可滚动。
区分两种渲染模式
Spherse 中的 HTML 有两种加载方式，决定了数据能否通过 fetch 访问同目录文件：
| 模式 | 加载方式 | 能否 fetch 同目录文件 |
典型场景 |
|---|---|---|---|
| 文件模式 | HTML 落在项目目录，经 preview 路由以 src 加载（真实 origin） |
✅ 可以 | Welcome Page、Content Browser 预览、HtmlCard 带 file_path |
| 字符串模式 | 纯 HTML 字符串经 srcDoc 加载（无真实 origin） |
❌ 不可以 | Chat HtmlCard 无 file_path |
判断方法：如果页面是作为文件写入用户项目目录（而非内联字符串），按「文件模式」处理。
何时将数据与渲染分离
实现一个 HTML 页面前，先判断它属于哪类，决定数据是「外置 JSON」还是「内联进 HTML」：
| 倾向 | 适用场景 | 做法 |
|---|---|---|
| 外置 JSON（推荐） | 信息量较大（多条目列表/表格/清单）、预计需要长期维护与更新、数据可能被其它页面复用 | 数据存成独立的 {页面名}.data.json 文件，HTML 只负责渲染并用 fetch 加载数据 |
| 内联进 HTML | 少量一次性展示内容、纯结构展示、字符串模式且无需持久化 | 数据直接写进 <script> 中的 JS 对象或 DOM |
外置的好处：数据与结构解耦，后续只改 JSON 即可更新内容，无需触碰 HTML；JSON 也可被其它页面 fetch 复用。
实现时务必用 write 工具分别落盘两个文件：HTML 页面（如
world/atlas.html）和数据文件（如world/atlas.data.json），不要只写 HTML。
只读展示数据：外置为同目录 JSON（文件模式推荐）
文件模式下，把页面需要的展示数据外置到同目录的 .json 文件，用 fetch 加载。这样数据与结构分离，便于维护和更新，也避免把大段数据塞进 HTML。
约定：数据文件名形如 {页面名}.data.json，与 HTML 同级。
假设页面为 world/atlas.html，数据文件为 world/atlas.data.json：
{
"regions": [
{ "name": "北境", "climate": "寒带", "faction": "守夜人" },
{ "name": "南境", "climate": "亚热带", "faction": "商会联盟" }
]
}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 267 lines · 123 tokens per session scan A e838cb957e2f
spherse-write-html is a skill published in the GitHub repository mengrru/Spherse (70 stars, last pushed 4d ago), licensed MIT. It adds 123 tokens to every session and 4,329 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
web-design
Penguin visual language for generated web pages and app UIs — GitHub-style simplicity with a single blue accent, light and pure-black dark themes, design tokens, component and chat-interface recipes, plus an opt-in warm paper editorial theme.
ui-secure-review
Review frontend and UI changes for concrete security risks such as XSS, unsafe URL handling, token leakage, missing origin checks, and client-side authorization gaps. Use when users ask for a UI code review focused on safety and reliability.
ui-resilient-accessibility
Build and review UI components for robust accessibility and runtime resilience, including semantic structure, keyboard support, loading and error states, retry flows, and predictable async behavior.
ui-safe-form-patterns
Implement or refactor UI forms with defense-in-depth validation, safe input handling, reliable submission behavior, and privacy-aware error handling. Use when building login, registration, profile, payment, admin, or file-upload forms.
aster-ui-demo
How to demo UI work the way Claude does it, never with throwaway HTML mockups. Build the change in the real webview, verify it in the browser harness, open the live dev server for the user to click through, and run the real test suites. Use when the user asks for a demo, a preview, or "let me see" any UI change in the…
deepseek-harness
Use when building AI agent applications with a plugin-based architecture — Web UI, CLI, Python SDK, Cordis plugin system, multi-model orchestration. DeepSeek Harness (dsh): open-source agent harness by DeepSeek AI where everything is a plugin, powered by Cordis for spatiotemporal composability.