Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/modakbul-gongbang/chromuxnpx agentmods add skills/modakbul-gongbang/chromux/chromux-workWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/modakbul-gongbang/chromux/chromux-work)<a href="https://agentmods.dev/skills/modakbul-gongbang/chromux/chromux-work"><img src="https://agentmods.dev/badge/skills/modakbul-gongbang/chromux/chromux-work/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/modakbul-gongbang/chromux/chromux-work"><img src="https://agentmods.dev/badge/skills/modakbul-gongbang/chromux/chromux-work.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Prompt Injection · line 208 This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.Fix: Remove or rewrite any text that instructs the agent to ignore prompts, override safety rules, or trust unverified content. Ensure skill content cannot be injected to alter agent behavior.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00047 | $0.05861 |
| Opus 5 | $0.00023 | $0.02930 |
| Sonnet 5 | $0.00009 | $0.01172 |
| Haiku 4.5 | $0.00005 | $0.00586 |
Grade B, and why
chromux-work scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Instruction-override phrasingmediumPrompt injection
Text telling the model to disregard its earlier instructions or safety rules is the shape of a prompt injection, whoever wrote it.
("ignore previous instructions", "run this command", "navigate to ... and Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 503 lines — stays where its author put it; the contents beside it link to each section on GitHub.
chromux-work
Use this workflow for browser tasks that need more than a single page check:
research, feed/search collection, logged-in site inspection, cross-page
verification, or parallel browser work. For command syntax, use the chromux
skill and chromux help.
This workflow applies to macOS, Linux, and native Windows. On Windows, prefer
PowerShell examples when installing or smoke-testing the CLI; browser work still
uses the same chromux command surface.
Contract
- Use chromux, not Playwright/Puppeteer, unless the user explicitly chooses a different tool.
- Start from a real chromux profile. Prefer an existing logged-in profile for user-owned sites.
- Same profile, different sessions: subagents share the selected profile and use unique session names. Concurrent cold starts are coordinated by chromux, but pre-launching the profile is still useful when you want faster first work.
- Recon first. Do not fan out before checking login state, page shape, blockers, site hints, and whether the task is parallel-safe.
- For crawling, use
CHROMUX_MODE=crawland a small worker-tab pool instead of one tab per URL. Default recommendation: 3 to 5 worker sessions per profile. - For plain URL batches, prefer
chromux batch --file urls.txt --workers N --retries N --host-backoff-ms MSinstead of asking subagents to hand-rollopen/runloops. - Treat
batchas a browser execution primitive, not a domain-specific extractor. Use it for URL load verification and simple page metadata; use checked-in per-site extractors when a task needs structured records. - For UI work, do not treat
openor an action response as proof. Usesnapshot,wait-for-text,wait-for-selector,run, orscreenshotto prove the resulting state. After an in-page action,snapshot --diffis the cheapest proof: it prints only what changed since your previous snapshot (action responses include it as thenextcommand). - Minimize round-trips: bundle a known multi-step sequence (navigate, click,
fill, wait, read back) into a single
chromux runcall instead of issuing many separateclick/fill/snapshotcommands. Each separate command is a full agent round-trip; onerunwithpage(...)/js(...)is far faster and is the main reason a single-call browser flow feels fast. - Use
chromux run --receipt PATHfor important QA or mutation-adjacent flows so the final report has redacted timing, state, and failure-kind evidence. - Observe with
snapshotbefore reaching forscreenshot. Usesnapshot --interactivewhen you only need actionable elements (buttons, links, inputs) — it returns a much smaller payload. Reservescreenshotfor visual verification a text snapshot cannot capture. - For canvas, range sliders, drag/drop, and other visual-only surfaces, read
chromux skill visual. Use measured screenshot coordinates withhover/click/drag; never assume screenshot pixels equal CSS units. - Default cross-origin frame recon is origin-only geometry.
Use
open --oopifonly when the task requires namespaced child refs or reliable child text actions, and refresh the snapshot after child navigation or detach. - For parent-controlled shutdown, use
chromux pause <profile>to reject new browser work, thenchromux resume <profile>before the next wave. - Keep work read-only unless the user explicitly asked to mutate state.
- Close every session you open. Do not suppress
chromux closeoutput unless the user explicitly asked for silence. chromux closes tabs idle for 30 minutes and shuts down an auto-launched browser 15 minutes after its last session ends, but that is a backstop for crashes and interruptions, not a reason to leave tabs open — everything you leave behind keeps a renderer alive until the timer fires. - After close, review any
knowledgeHint. Update~/.chromux/skills/<host>/*.mdwhen this run revealed durable public site behavior or stale/wrong notes. - Treat a
learnNextfield on anyopenorcloseresponse as a required checkpoint, not a suggestion. It appears only when the host has no durable knowledge yet or one of its files has gone stale, and it names the oldest file plus the exactchromux note/chromux script savecommands. Do not end the task with an unaddressedlearnNext: either save what this run proved, or state why nothing durable was learned. This is the write half of the learning loop — skipping it is why a host stays expensive on every future visit. - If a hint turned out to be wrong, edit that file and remove the wrong
claim.
note --addappends, so correcting with it leaves the wrong claim and its rebuttal side by side and the next agent believes whichever it reads first. Hint headers andlearnNextboth carry the real path; open it with your normal file tools. Writing a new note in a sibling file does not clear the stale one. - When a derived flow (selectors, waits, extraction) worked and is likely to
be repeated, save it as a replay script:
chromux script save <host>/<name> --file flow.js. Future runs on that host see it in theopenresponse and replay it withchromux run <session> --script <host>/<name>instead of re-deriving the flow. If a replay fails, fix the script against a fresh snapshot and save it again. For structured extraction, pair the script with--schemaso results that drift from the expected shape fail loudly.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 503 lines · 47 tokens per session scan B 0296fc5983f9
chromux-work is a skill published in the GitHub repository modakbul-gongbang/chromux (40 stars, last pushed 17d ago), licensed MIT. It adds 47 tokens to every session and 5,861 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 1 finding (instruction-override phrasing). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
debug-optimize-lcp
Guides debugging and optimizing Largest Contentful Paint (LCP) using Chrome DevTools MCP tools. Use this skill whenever the user asks about LCP performance, slow page loads, Core Web Vitals optimization, or wants to understand why their page's main content takes too long to appear. Also use when the user mentions…
opencli-sitemap-author
Use when creating or maintaining OpenCLI site sitemaps: agent-facing navigation, page-state, action, workflow, API-reference, pitfall, and fallback knowledge for a website. Use after browser exploration discovers durable site context, when a sitemap is stale, or when promoting local site knowledge into the repo.
interactive-login
How to complete browser/interactive logins (aws / gh / glab / gcloud). The platform backgrounds the login poller so it survives the human's browser round-trip — and when that does NOT work.
pinchtab-mcp
Use this skill when a task requires browser automation through PinchTab's MCP server connected to a remote browser instance. Covers navigation, element interaction, data extraction, form filling, multi-step flows, and session management via MCP tools.
azure-messaging-webpubsub-java
Build real-time web applications with Azure Web PubSub SDK for Java. Use when implementing WebSocket-based messaging, live updates, chat applications, or server-to-client push notifications.
google-safe-browsing
Prevent and fix Google Safe Browsing "Dangerous site" flags. Use when launching a public web app, buying/picking a domain, building a login or signup page, or when any site shows a red "Dangerous site" / "Deceptive site" warning in Chrome, Brave, Safari, Firefox, or Edge. Triggers on "dangerous site", "deceptive…