Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mxyhi/ok-skills --skill kimi-webbridgegit clone --depth 1 https://github.com/mxyhi/ok-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mxyhi/ok-skills/kimi-webbridge)<a href="https://agentmods.dev/skills/mxyhi/ok-skills/kimi-webbridge"><img src="https://agentmods.dev/badge/skills/mxyhi/ok-skills/kimi-webbridge/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mxyhi/ok-skills/kimi-webbridge"><img src="https://agentmods.dev/badge/skills/mxyhi/ok-skills/kimi-webbridge.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Data Exfiltration · line 42 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Excessive Agency · line 162 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00141 | $0.04898 |
| Opus 5.5 | $0.00056 | $0.01959 |
| Sonnet 5.5 | $0.00028 | $0.00980 |
| Haiku 4.5 | $0.00014 | $0.00490 |
Grade B, and why
kimi-webbridge scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
curl -s -X POST http://127.0.0.1:10086/command -H 'Content-Type: application/json' --data-binary @/tmp/webbridge-req-<random>.json Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s -X POST http://127.0.0.1:10086/command \ Copies of this mod
2 near-identical copies found in the catalogue:
- kimi-webbridge — 97% identical, 82 lines differ
- kimi-webbridge — 95% identical, 85 lines differ
How it starts
The opening of the file, as written. The whole thing — 194 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Kimi Browser Extension (formerly Kimi WebBridge)
Control the user's real browser (with their login sessions) via a local daemon at http://127.0.0.1:10086 (the default address — see If a tool call fails for when it differs).
When the user asks to build a reusable CLI tool or script for a website (rather than do a one-off task), follow references/cli-creator/workflow.md. Its phases say when to read each of these:
references/cli-creator/site-exploration.md— the protocol for finding how each feature gets its datareferences/cli-creator/login-handling.md— when the site requires loginreferences/cli-creator/go-layout.md— when the CLI is written in Goreferences/cli-creator/companion-skill-template.md— the template for the skill that tells agents how to use the CLI
Tools
| Tool | Args | Returns | Note |
|---|---|---|---|
navigate |
url, newTab(bool), group_title |
{success, url, tabId} |
First call opens a tab — see Tabs. group_title sets the group's visible label |
find_tab |
url, active(bool) |
{success, url, tabId, borrowed} |
Re-select a tab this session opened; active:true borrows the tab the user is viewing — see Tabs |
snapshot |
optional ref; format:"aria" opts into text with optional max_chars (1–60000), or cursor to continue |
Default {url, title, tree}; ARIA {url, title, tree_text} |
Accessibility tree (text) — use this to read page content and locate elements |
click |
selector (@e ref or CSS) |
{success, tag, text} |
Synthetic el.click() |
fill |
selector, value |
{success, tag, mode} |
Works on <input>/<textarea> AND [contenteditable] (ProseMirror/Lexical/Slate). mode is "value" or "contenteditable" |
evaluate |
code (for await, wrap it in an async IIFE — top-level await is a SyntaxError) |
{type, value} |
|
cdp |
method, params |
raw CDP response | Raw chrome.debugger passthrough — what evaluate is to JS, cdp is to CDP. Low-level escape hatch for cases the tools above don't cover. Page.bringToFront is a last resort: while focus emulation is off on a tab, a call turns it on instead of activating the tab (the tab renders and takes real input without being switched to); only a call once emulation is on activates, and it never pulls Chrome over another app the user is in. Target.activateTarget is refused |
screenshot |
format(png|jpeg), quality(0-100), optional selector (@e/CSS), optional path |
{format, path, sizeBytes, mimeType} |
Returns a file path, not base64 — see Screenshots |
network |
cmd(start|stop|list|detail), filter(URL substring, for list), requestId(for detail) |
list: {count, requests:[{requestId, url, method, status, mimeType, completed}]}; detail: that request plus requestHeaders, requestBody, body (the response) |
Capture is per tab, from start on. Call detail before stop — stopping releases the response bodies, and detail then returns bodyError instead of body |
upload |
selector, files(string[]) |
{success, fileCount} |
|
save_as_pdf |
paper_format, landscape, scale, print_background, optional path |
{path, sizeBytes, mimeType, pageTitle} |
Render current page → PDF, returns a file path — see Save as PDF |
list_tabs |
— | {success, tabs:[{tabId, url, title, active, groupTitle}]} |
Inspect tabs in the current session |
list_browser_tabs |
— | {success, tabs:[{tabId, windowId, url, title, active}]} |
Inspect all tabs visible to this WebBridge connection, across windows; does not attach or focus a tab |
attach_tab |
tabId |
{success, tabId, url, title, borrowed} |
Attach a specific existing tab to this session without focusing it; borrowed tabs survive close_session |
close_tab |
— | {success, closed: bool} |
Close the current tab in the session |
close_session |
— | {success, closed: int} |
Close tabs opened by this session; borrowed tabs stay open. closed is the count. See Sessions for when to call |
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago Changed · +4 lines d7d27849b814
- 26d ago Changed · +1 lines · +14 tokens per session 07548b3a497a
- 1mo ago Changed · +14 tokens per session 432ed1aa6489
- 1mo ago First seen · 189 lines · 113 tokens per session scan B 3e4885be37b1
kimi-webbridge is a skill published in the GitHub repository mxyhi/ok-skills (506 stars, last pushed 9d ago), licensed Apache-2.0. It adds 141 tokens to every session and 4,898 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it B with 2 findings (sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
browser-testing-with-devtools
Tests in real browsers via Chrome DevTools MCP. Use when building or debugging anything that runs in a browser. Use when you need to inspect the DOM, capture console errors, analyze network requests, profile performance, or verify visual output with real runtime data. Requires the chrome-devtools MCP server to be…
awesome-content-publisher
Publishes prepared posts to the user's own accounts through their live browser, on schedule, with login checks, a no-duplicates ledger and a confirmation gate before anything goes public. Use when asked to publish posts.
browser_cdp
Use this skill when the user explicitly wants to connect to a running Chrome browser, scan local CDP ports, specify a cdpport, or share a single browser across multiple agents/tools. By default, browseruse already launches the browser using managed CDP; if the user does not want to expose browser history, cookies, or…
browser_cdp
A guide for connecting browser-control tools to an existing Chrome session through its remote debugging interface. It explains scanning ports, attaching to a browser, choosing a port, sharing a browser, and switching to a more private control mode.
browser_visible
A guide to browseruse launch settings for Chromium-based browsers. It covers visible windows, private control, extra browser start options such as incognito mode or a proxy, and choosing a browser executable path.
browser_visible
Use this skill when the user needs to control the browser launch mode for browseruse. By default, browseruse launches the local Chrome/Chromium using managed CDP; headed controls whether the window is visible, and privatemode controls whether CDP is disabled in favor of Playwright.