Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add oxylabs/agent-skills --skill web-unblockergit clone --depth 1 https://github.com/oxylabs/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/oxylabs/agent-skills/web-unblocker)<a href="https://agentmods.dev/skills/oxylabs/agent-skills/web-unblocker"><img src="https://agentmods.dev/badge/skills/oxylabs/agent-skills/web-unblocker/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/oxylabs/agent-skills/web-unblocker"><img src="https://agentmods.dev/badge/skills/oxylabs/agent-skills/web-unblocker.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 21 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 60 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00069 | $0.00981 |
| Opus 5 | $0.00034 | $0.00491 |
| Sonnet 5 | $0.00014 | $0.00196 |
| Haiku 4.5 | $0.00007 | $0.00098 |
Grade A, and why
web-unblocker scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -k -x "https://unblock.oxylabs.io:60000" \ How it starts
The opening of the file, as written. The whole thing — 98 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Oxylabs Web Unblocker
AI-powered proxy solution that automatically manages fingerprinting, headers, retries, and JavaScript rendering.
Endpoint
https://unblock.oxylabs.io:60000
Authentication
HTTP Basic Auth via proxy credentials:
curl -k -x "https://unblock.oxylabs.io:60000" \
-U "$OXYLABS_USERNAME:$OXYLABS_PASSWORD" \
"https://example.com"
Quick Start
Basic request:
curl -k -x "https://unblock.oxylabs.io:60000" \
-U "$OXYLABS_USERNAME:$OXYLABS_PASSWORD" \
"https://ip.oxylabs.io/headers"
With JavaScript rendering:
curl -k -x "https://unblock.oxylabs.io:60000" \
-U "$OXYLABS_USERNAME:$OXYLABS_PASSWORD" \
-H "x-oxylabs-render: html" \
"https://example.com/spa-page"
Headers
| Header | Description |
|---|---|
x-oxylabs-render |
html for rendered HTML, png for raw PNG bytes; empty value disables automatic forced rendering |
X-Oxylabs-Session-Id |
Reuse same IP across requests (any random string) |
X-Oxylabs-Geo-Location |
Target country, city/state, ZIP/postcode, or coordinates |
x-oxylabs-force-headers: 1 |
Enable custom header passthrough |
x-oxylabs-force-cookies: 1 |
Enable custom cookie passthrough |
X-Oxylabs-Successful-Status-Codes |
Define custom success codes to prevent retries |
x-oxylabs-browser-instructions |
JSON-escaped browser actions; requires x-oxylabs-render: html |
Session Persistence
Reuse the same IP across multiple requests:
curl -k -x "https://unblock.oxylabs.io:60000" \
-U "$OXYLABS_USERNAME:$OXYLABS_PASSWORD" \
-H "X-Oxylabs-Session-Id: my-session-123" \
"https://example.com/page1"
Geo-Location Targeting
curl -k -x "https://unblock.oxylabs.io:60000" \
-U "$OXYLABS_USERNAME:$OXYLABS_PASSWORD" \
-H "X-Oxylabs-Geo-Location: Germany" \
"https://example.com"
Use values such as Germany, 90210, California,United States, New York,New York,United States, or lat: 40.7128, lng: -74.0060, rad: 50.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 98 lines · 69 tokens per session scan A c1e9dbaf4043
web-unblocker is a skill published in the GitHub repository oxylabs/agent-skills (871 stars, last pushed 19d ago), licensed MIT. It adds 69 tokens to every session and 981 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
safari-extension-control-workflow
Guide macOS Safari integration decisions across Safari Web Extensions, Safari Web Inspector Extensions, Safari App Extensions, SafariServices APIs, content blockers, extension messaging, and app-to-Safari control surfaces. Use when the user wants a Mac app to extend, message, open, inspect, debug, or coordinate with…
safari-mcp-workflow
Inspect a scoped live site in Safari through Safari Technology Preview's local MCP server. Use for Safari-specific DOM, console, network, screenshot, accessibility, performance, interaction, responsive, or print-media evidence.
nexus-browser-fleet
Headless browser fleet orchestration and management. Use when you need to coordinate multiple headless browser instances for automated web auditing, scraping, or testing at scale using tools like Pinchtab. Detects and corrects unstable fleets that fail audit coverage.
add-tavily-tool
Add Tavily Search and Extract as keyless remote MCP tools for selected NanoClaw agent groups. Use when installing Tavily web search or URL extraction without an API key.
broken-link-checker
Scans a website to find broken links (404s, 500s). Crawls internal pages, identifies broken outbound links, and reports source pages for easy fixing. Use this when the user asks to "check for broken links", "find 404s", "audit my links", or "is my site healthy".
dev-browser
Browser automation with persistent page state. Use when users ask to navigate websites, fill forms, take screenshots, extract web data, test web apps, or automate browser workflows. Trigger phrases include "go to [url]", "click on", "fill out the form", "take a screenshot", "scrape", "automate", "test the website"…