Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add OrcaQubits/agentic-commerce-skills-plugins --skill nlweb-setupgit clone --depth 1 https://github.com/OrcaQubits/agentic-commerce-skills-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/orcaqubits/agentic-commerce-skills-plugins/nlweb-setup)<a href="https://agentmods.dev/skills/orcaqubits/agentic-commerce-skills-plugins/nlweb-setup"><img src="https://agentmods.dev/badge/skills/orcaqubits/agentic-commerce-skills-plugins/nlweb-setup/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/orcaqubits/agentic-commerce-skills-plugins/nlweb-setup"><img src="https://agentmods.dev/badge/skills/orcaqubits/agentic-commerce-skills-plugins/nlweb-setup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00073 | $0.01647 |
| Opus 5 | $0.00036 | $0.00823 |
| Sonnet 5 | $0.00015 | $0.00329 |
| Haiku 4.5 | $0.00007 | $0.00165 |
Grade B, and why
nlweb-setup scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
- `curl -X POST http://localhost:8000/mcp -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'` → `ask`, `list_sites`, optionally `who` Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- `curl http://localhost:8000/sites` → JSON list including your loaded site How it starts
The opening of the file, as written. The whole thing — 114 lines — stays where its author put it; the contents beside it link to each section on GitHub.
NLWeb Setup
Config layout changed upstream. NLWeb replaced the single
site_types.xmlwith two files inconfig/:sites.xml(site name →itemTypelist + description) andtools.xml(per-site / per-type tool definitions, prompts and examples, scoped by<Site id="…">/<Item>blocks). Older guidance — including anysite_type/extendsinheritance syntax — describes the retired file. Fetchconfig/sites.xmlandconfig/tools.xmlfrom the live repo before editing anything.
Before writing code
Fetch live docs first:
- Fetch https://github.com/nlweb-ai/NLWeb (README) for the current minimum Python version and required deps.
- Fetch https://github.com/nlweb-ai/NLWeb/blob/main/docs/nlweb-hello-world.md for the canonical hello-world flow.
- Fetch https://github.com/nlweb-ai/NLWeb/blob/main/docs/nlweb-cli.md for current
nlwebCLI flags. - Web-search
site:github.com/nlweb-ai/NLWeb docs/release_notesand read the most recent dated release note — config keys and required env vars change between releases. - Identify the default
write_endpointand verify which backends are enabled by default inconfig/config_retrieval.yamlonmain.
Conceptual Architecture
What "setup" produces
A working NLWeb dev environment has four parts:
- Cloned repo + Python virtualenv with requirements installed.
.envfile with provider credentials (OpenAI/Azure OpenAI key + retrieval backend secrets).- Sample data ingested into the local vector store (Qdrant local by default).
- A running aiohttp server on
:8000with/ask,/mcp,/sitesreachable.
Three Default-Enabled Backends — Watch Out
NLWeb ships with three retrieval backends enabled by default in config_retrieval.yaml:
qdrant_local(file-backed, fine for dev)nlweb_west(Azure AI Search — requires Azure credentials)shopify_mcp(queries Shopify's MCP endpoint, requires network)
For most local-dev cases, disable the latter two by setting enabled: false so you don't get connection errors at startup. The write_endpoint should point to qdrant_local for dev.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 114 lines · 73 tokens per session scan B f80ac0fb584c
nlweb-setup is a skill published in the GitHub repository OrcaQubits/agentic-commerce-skills-plugins (39 stars, last pushed 2d ago), licensed MIT. It adds 73 tokens to every session and 1,647 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it B with 2 findings (sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-15.
Other skills, from other repositories
archestra-dev-llm-providers
Use when adding an LLM provider, changing proxy adapters or provider routes, fixing streaming/tool-call translation bugs, editing model fetchers or model handling, or touching provider credentials/enums and model constants.
andrej-karpathy-v2
ANDREJ KARPATHY — SKILL COMPLETA v2.0 workflow skill. Use this skill when the user needs Agente que simula Andrej Karpathy — ex-Director of AI da Tesla, co-fundador da OpenAI, fundador da Eureka Labs, e o maior educador de deep learning do mundo and the operator should preserve the upstream workflow, copied support…
chaingpt
Build with the ChainGPT Web3 AI developer platform. Full API/SDK reference and project scaffolding for: Web3 AI Chatbot & LLM, AI NFT Generator, Smart Contract Generator, Smart Contract Auditor, AI Crypto News, AgenticOS Twitter agents, and Solidity LLM. Use when building blockchain apps, Web3 chatbots, NFT tools…
switchboard
Complete Switchboard Oracle Protocol SDK for Solana - the permissionless oracle solution for price feeds, on-demand data, VRF randomness, and real-time streaming via Surge. Covers TypeScript SDK, Rust integration, Oracle Quotes, and all Switchboard tools.
0g-compute
0G Compute Network guide for decentralized AI inference, fine-tuning, and GPU services. Covers chatbots, image generation, speech-to-text, SDK integration (0g-serving-broker), processResponse API, broker.inference methods, CLI commands (0g-compute-cli), and account management. Use this skill for any 0G compute, 0G AI…
near-ai-cloud
NEAR AI Cloud private inference and verification. Use when integrating NEAR AI Cloud API for verifiable private AI inference, verifying model or gateway TEE attestation (NVIDIA NRAS, Intel TDX), verifying chat message signatures, implementing end-to-end encrypted chat, or using the OpenAI-compatible API with NEAR AI…