Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/securitytalent/bugskill-ai/crawlnpx skills add SecurityTalent/bugskill-ai --skill crawlgit clone --depth 1 https://github.com/SecurityTalent/bugskill-aiWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00076 | $0.02510 |
| Opus 5 | $0.00038 | $0.01255 |
| Sonnet 5 | $0.00015 | $0.00502 |
| Haiku 4.5 | $0.00008 | $0.00251 |
Grade A, and why
crawl scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 339 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Web Crawling Skill
Overview
This skill enables deep web crawling using hakrawler and gospider to discover subdomains, extract endpoints, analyze JavaScript files, and map web application attack surfaces. The skill provides a unified Python wrapper that combines both tools for comprehensive URL discovery and categorization. All bash command outputs (stdout/stderr) are automatically logged for debugging and analysis.
When to Use This Skill
Use this skill when users request:
- Crawling or spidering a URL or domain
- Subdomain discovery and enumeration
- Endpoint and API discovery
- JavaScript file extraction and analysis
- Web application reconnaissance or mapping
- Bug bounty scoping and enumeration
- Attack surface discovery
Trigger keywords: crawl, spider, enumerate, discover subdomains, find endpoints, map application, recon, reconnaissance
Quick Start
The primary tool is scripts/crawl.py, which provides a unified interface to both hakrawler and gospider:
# Basic crawl - creates crawl_example.com_TIMESTAMP/
python scripts/crawl.py https://example.com
# Deep crawl with subdomain discovery
python scripts/crawl.py https://example.com --depth 3 --subdomains
# Crawl with JS analysis
python scripts/crawl.py https://example.com --js-analysis
# Use only one tool
python scripts/crawl.py https://example.com --tool hakrawler
# Custom output directory and timeout
python scripts/crawl.py https://example.com --output-dir ./results --timeout 600
Note: The script automatically creates timestamped output directories following the pattern crawl_{DOMAIN}_{timestamp}/ unless a custom output directory is specified.
Tool Installation
If the crawling tools are not installed, use the installation helper:
bash scripts/install_tools.sh
Or install manually:
go install github.com/hakluke/hakrawler@latest
go install github.com/jaeles-project/gospider@latest
export PATH=$PATH:~/go/bin
Verify with: python scripts/crawl.py --install
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 339 lines · 76 tokens per session scan A d1eb0d7e6bb4
crawl is a skill published in the GitHub repository SecurityTalent/bugskill-ai (5 stars, last pushed 17d ago), licensed MIT. It adds 76 tokens to every session and 2,510 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
playwright-best-practices
Use when writing Playwright tests, fixing flaky tests, debugging failures, implementing Page Object Model, configuring CI/CD, optimizing performance, mocking APIs, handling authentication or OAuth, testing accessibility (axe-core), file uploads/downloads, date/time mocking, WebSockets, geolocation, permissions…
fullpage-screenshot
Capture full-page screenshots of a website at several viewport widths at once, including pages behind basic auth or needing setup clicks. Use when asked to screenshot a site, grab full-page captures, check a page across breakpoints, produce responsive review artefacts, or compare how a layout renders at mobile, tablet…
legado-book-source-generator
Use when 用户要求为任意网站生成书源、生成阅读书源、分析小说站点、生成 Legado/阅读规则。强制触发词：书源、生成书源、帮我生成、book source、legado、阅读书源、小说站点分析。如果用户给出了一个 URL 并要求生成或分析，必须加载此 skill。.
serpbase-skill
Agent-portable SerpBase skill for Codex, Claude Code, OpenClaw, opencode, and other AI coding/research agents. Use when an agent needs current Google Search, Images, News, Videos, Google Maps local search, or Google Maps place detail results through serpbase.dev; when configuring search grounding through SerpBase; or…
hasdata
Use HasData to scrape any public web page, run real-time Google/Bing/Google-AI-Mode search queries, pull structured data from e-commerce, real-estate, lodging, jobs, maps, travel, video, and social platforms, or run async bulk-scraping and crawling jobs without managing proxies, browsers, or captchas. Reach for this…
electron
Automate Electron desktop apps (VS Code, Slack, Discord, Figma, Notion, Spotify, etc.) using agent-browser via Chrome DevTools Protocol. Use when the user needs to interact with an Electron app, automate a desktop app, connect to a running app, control a native app, or test an Electron application. Triggers include…