Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add saffron-health/libretto --skill libretto-readonlygit clone --depth 1 https://github.com/saffron-health/librettoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/saffron-health/libretto/libretto-readonly)<a href="https://agentmods.dev/skills/saffron-health/libretto/libretto-readonly"><img src="https://agentmods.dev/badge/skills/saffron-health/libretto/libretto-readonly/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/saffron-health/libretto/libretto-readonly"><img src="https://agentmods.dev/badge/skills/saffron-health/libretto/libretto-readonly.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Data Exfiltration · line 77 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00026 | $0.01009 |
| Opus 5 | $0.00013 | $0.00504 |
| Sonnet 5 | $0.00005 | $0.00202 |
| Haiku 4.5 | $0.00003 | $0.00101 |
Grade A, and why
libretto-readonly scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 91 lines — stays where its author put it; the contents beside it link to each section on GitHub.
How Libretto Read-Only Works
- Use this skill when the browser session must stay strictly read-only.
- Libretto stores read-only vs write-access on the session itself.
- The primary inspection tools are
snapshotandreadonly-exec. readonly-execreuses Libretto's normal execution pipeline, but it only exposes read-only helpers and denies mutating Playwright methods.- Only a user can change the session mode for an existing session. Never change a session's mode on your own — the user must change it themselves manually.
Working Rules
- Announce which session you are using and what page you are inspecting.
- Do not use
exec,run, or any direct Playwright action that could change browser or application state. - Do not click, type, submit forms, navigate, upload files, dispatch DOM events, or send non-GET requests.
- Prefer
snapshotfirst when the visible page state is unclear. - Use
readonly-execfor focused inspection: titles, HTML, locator text, counts, visibility checks, and GET requests. - Keep snippets small and purpose-built. Do not run multiple
readonly-execcommands at the same time. - Close disposable sessions before your final response once inspection is complete. Open browsers keep consuming local or hosted resources.
- End with diagnosis and handoff guidance, not an attempted in-browser repair.
Commands
connect
- Use
connectto attach to an existing CDP endpoint for a preserved browser session. - Use
--read-onlywhen creating the Libretto session handle for a preserved browser session. - Libretto read-only mode is enforced through Libretto commands; direct CDP clients that skip Libretto are outside this boundary.
libretto connect http://127.0.0.1:9222 --read-only --session failed-job-debug
pages
- Use
pageswhen a popup, new tab, or second page exists. - If
readonly-execorsnapshotcomplains about multiple pages, list ids first and then pass--page.
libretto pages --session failed-job-debug
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 91 lines · 26 tokens per session scan A ff41091a7efb
libretto-readonly is a skill published in the GitHub repository saffron-health/libretto (889 stars, last pushed 19d ago), licensed MIT. It adds 26 tokens to every session and 1,009 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
robotgo-flow
Use when building YAML-driven Windows RPA workflows in Go — step-by-step desktop automation with image template matching, interactive recording mode, hotkey triggers. RobotGo-Flow: YAML-based Windows RPA framework built on RobotGo.
qirabot
Drive any GUI with AI vision on raw screenshots — no DOM, no CSS/XPath selectors — via the Qirabot Python SDK or the qirabot CLI. Hand it a whole goal to complete autonomously, or make single natural-language actions: click, type, extract, and verify on web browsers, Android, iOS, desktop apps, and games. Use this…
wx4-skill
A WeChat automation tool. WeChat is a messaging platform used for one-to-one and group chats, file sharing, and community management.
qirabot
Drive any GUI with AI vision on raw screenshots — no DOM, no CSS/XPath selectors — via the Qirabot Python SDK or the qirabot CLI. Hand it a whole goal to complete autonomously, or make single natural-language actions: click, type, extract, and verify on web browsers, Android, iOS, desktop apps, and games. Use this…
playwright-cli
Automate browser interactions, test web pages and work with Playwright tests.
hive.slack-notifications-setup
Set up a Slack notification channel (Sentinel) for a colony by driving the browser — reuse or create the "Hive Sentinel" Slack app from a JSON manifest, install it, capture the bot + app tokens, create/select the channel via the Slack API, and turn Sentinel on so the colony can ping the user on Slack and accept…