Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add quangpl/browser-extension-skills --skill extension-backendgit clone --depth 1 https://github.com/quangpl/browser-extension-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/quangpl/browser-extension-skills/extension-backend)<a href="https://agentmods.dev/skills/quangpl/browser-extension-skills/extension-backend"><img src="https://agentmods.dev/badge/skills/quangpl/browser-extension-skills/extension-backend/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/quangpl/browser-extension-skills/extension-backend"><img src="https://agentmods.dev/badge/skills/quangpl/browser-extension-skills/extension-backend.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00049 | $0.01020 |
| Opus 5 | $0.00024 | $0.00510 |
| Sonnet 5 | $0.00010 | $0.00204 |
| Haiku 4.5 | $0.00005 | $0.00102 |
Grade A, and why
extension-backend scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 114 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Extension Backend
Build a secure, maintainable backend API for a Chrome extension. Recommended stack: NestJS + MongoDB (Mongoose).
When to Activate
Activate this skill when extension work requires:
- License verification / payment webhooks
- User authentication / account management
- Data sync across devices
- External API proxy (hide API keys from extension)
- Any server-side logic
Workflow (Execute This)
Step 1: Ask user to confirm requirements
- Do you need a backend? (explain why: API keys, auth, payments, sync)
- Stack preference: NestJS + MongoDB (recommended) or custom?
- Hosting target: Vercel / Railway / Fly.io / AWS / self-hosted?
- Features needed (pick from):
- User auth (Google OAuth via chrome.identity)
- License/subscription verification
- Payment webhooks (Stripe, Paddle, etc.)
- Data sync / storage API
- External API proxy
- Rate limiting
Step 2: Fetch framework docs
Use docs-seeker skill to fetch latest docs:
- NestJS: https://docs.nestjs.com/
- Mongoose: https://mongoosejs.com/docs/
- TypeScript style: https://google.github.io/styleguide/tsguide.html
- JavaScript style: https://google.github.io/styleguide/jsguide.html
Step 3: Scaffold the backend
npx @nestjs/cli new extension-backend --strict --package-manager pnpm
cd extension-backend
pnpm add @nestjs/mongoose mongoose @nestjs/config class-validator class-transformer
pnpm add helmet @nestjs/throttler
pnpm add -D @types/express
Step 4: Project structure
src/
├── main.ts # Bootstrap, CORS, helmet, validation
├── app.module.ts # Root module
├── config/
│ └── configuration.ts # Env-based config
├── auth/
│ ├── auth.module.ts # Auth module
│ ├── auth.controller.ts # POST /auth/verify-token
│ ├── auth.service.ts # Token validation logic
│ └── guards/auth.guard.ts # Global auth guard
├── license/
│ ├── license.module.ts
│ ├── license.controller.ts # GET /license/verify
│ ├── license.service.ts # License CRUD
│ └── schemas/license.schema.ts # Mongoose schema
├── webhook/
│ ├── webhook.module.ts
│ ├── webhook.controller.ts # POST /webhook/stripe
│ └── webhook.service.ts # Process payment events
└── common/
├── filters/http-exception.filter.ts
├── interceptors/logging.interceptor.ts
└── dto/ # Shared DTOs
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 114 lines · 49 tokens per session scan A fdbd556179ef
extension-backend is a skill published in the GitHub repository quangpl/browser-extension-skills (49 stars, last pushed 3mo ago), licensed MIT. It adds 49 tokens to every session and 1,020 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
nosqli
NoSQL injection — MongoDB operator injection ($ne, $gt, $where, $regex), CouchDB / Firebase / Redis attack patterns, auth bypass, blind extraction.
openloomi-api
OpenLoomi ships a local-first HTTP API served from the desktop app (port 3414, fallback 3515). All auth, Memory, AI, RAG, Loop, and Audit data live in a local SQLite database — your data stays on your machine and the OpenLoomi app is the source of truth. The only externally-routed auth path is the Composio OAuth…
byted-supabase
A command-line and chat-based operations guide for Volcengine’s Supabase-compatible backend platform, including databases, authentication, storage, realtime data, server functions, and hosting. It is a Volcengine service, not the official open-source Supabase product.
api-reference
Memoria REST API endpoints, request/response formats, auth, rate limits. Use when calling or implementing API endpoints.
byted-volcengine-mongodb
An operations tool for Volcengine MongoDB, a document database that stores data in flexible, JSON-like records. It can query managed MongoDB instances and return details for further explanation or diagnosis.
dynamic
Fullstack development with bkend.ai BaaS — authentication, database, API integration. Triggers: fullstack, BaaS, login, signup, database, web app.