Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/seed-forge/harness-ai-kit/devlab-web-extension-bootstrapnpx skills add seed-forge/harness-ai-kit --skill devlab-web-extension-bootstrapgit clone --depth 1 https://github.com/seed-forge/harness-ai-kitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/seed-forge/harness-ai-kit/devlab-web-extension-bootstrap)<a href="https://agentmods.dev/skills/seed-forge/harness-ai-kit/devlab-web-extension-bootstrap"><img src="https://agentmods.dev/badge/skills/seed-forge/harness-ai-kit/devlab-web-extension-bootstrap.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00090 | $0.03036 |
| Opus 5 | $0.00045 | $0.01518 |
| Sonnet 5 | $0.00018 | $0.00607 |
| Haiku 4.5 | $0.00009 | $0.00304 |
Grade A, and why
devlab-web-extension-bootstrap scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 162 lines — stays where its author put it; the contents beside it link to each section on GitHub.
DevLab Web Extension Bootstrap
用途
从零构建一个浏览器扩展（WebExtension / Manifest V3）的团队标准工作流，尤其适用于"从某个已有 Web 应用里提取、下载或增强内容"这类扩展。
核心原则：这类扩展的成败取决于检测层（detection layer），而不是 UI。 按钮谁都会写；难的是在多种页面形态（应用页 / SSR 分享页 / 未登录页）和登录态下都能稳定定位到目标资产。所以先逆向、验证能拿到资产，再写 UI。
把扩展当作有生命周期的产品来做：可行性 → 逆向工程 → 技术选型 → 架构 → 测试。代码验证通过后，开源与发布交给 devlab-github-oss-ops。
适用场景
- 新建浏览器扩展（Chrome/Edge/Firefox，MV3）
- 需要从特定 Web 应用读取 / 下载 / 增强内容的扩展
- 必须兼容多种页面类型（应用页、SSR 分享页、登出态）的扩展
- 把"网站能加载但不给我保存"变成一个可用工具
不适用：
- 纯 Web 应用或无需打包的 userscript
- 一次性的 DevTools console 片段
- 开源打包 / GitHub 发布阶段（用
devlab-github-oss-ops）
输入
| 输入项 | 是否必须 | 来源 |
|---|---|---|
| 目标 Web 应用 URL + 要提取的内容 | 是 | 用户描述 |
| 需覆盖的页面类型清单 | 是 | 逆向阶段枚举（应用页/分享页/登出页） |
| 目标浏览器 | 交互确认 | 默认 Chrome MV3 |
输出
- 一个可加载的 MV3 扩展（content script + background + popup）
- 一个纯函数、可注入、可单测的检测层
- 单元测试 + 真实浏览器 e2e 闭环
- 交接给
devlab-github-oss-ops的就绪代码
工作流
调用本技能时的标准顺序：
- 判定是否真的需要扩展（§1）
- 逆向目标站点的数据通道（§2）—— 成败关键
- 选型并脚手架（§3）
- 搭建三面架构（§4）
- 单测 + 真实浏览器 e2e 证明（§5）
- 过验收门禁，交接
devlab-github-oss-ops做开源与发布
配合 brainstorming（§1 前，新点子）、writing-plans（§4 前，多步实现）、test-driven-development（§5）、verification-before-completion（宣称就绪前）。
§1 可行性与范围
动手前确认：
- 你要的内容在你浏览查看时已经被加载进浏览器（扩展只能保存页面在你会话下已能访问的内容）
- 你提取的是你自己的内容、走平台自己的端点（不破解/绕过付费墙——这既是合规红线也是维护陷阱）
- 目标有可识别的数据通道（见 §2），而非纯 canvas/WebGL 不可解析渲染
- 提前枚举必须支持的页面类型：应用/编辑器页、公开分享页、登出页。每种暴露数据的方式可能不同。
产出：一句话问题陈述 + 需覆盖的页面类型清单。
§2 逆向目标站点（关键阶段）
目标：找出页面暴露资产 URL / 标识符的所有途径，然后实现一个按可靠性排序、逐级兜底的多通道检测器。
按优先级排查（🔒 HUMAN-DECISION [HD-1] 通道优先级由实证确定）：
- SSR 注入的初始状态 —— 现代 React/Next.js 应用把初始数据内嵌在 HTML 里。找
self.__next_f.push(...)、__NEXT_DATA__、window.__INITIAL_STATE__或内联<script>JSON。这是最丰富最稳定的来源，且在分享页登出态也有效。 - 同源 API / 代理 —— 前端常调自己的
/api/...（有时是/api/proxy?url=<backend>模式）。用credentials: 'include'复用，自动携带用户会话。 - 由路径标识符构造 URL —— 若分享 URL 如
/e/<hash>能确定性映射到公开资产端点，则无需任何页面数据即可构造下载 URL。 - 被动资源观察 ——
performance.getEntriesByType('resource')（或PerformanceObserver）暴露页面已加载的资产 URL。作为最后兜底。
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 162 lines · 90 tokens per session scan A 60cb6adff487
devlab-web-extension-bootstrap is a skill published in the GitHub repository seed-forge/harness-ai-kit (21 stars, last pushed 4d ago), licensed Apache-2.0. It adds 90 tokens to every session and 3,036 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
browser-testing-with-devtools
Tests in real browsers via Chrome DevTools MCP. Use when building or debugging anything that runs in a browser. Use when you need to inspect the DOM, capture console errors, analyze network requests, profile performance, or verify visual output with real runtime data. Requires the chrome-devtools MCP server to be…
playwright-recording
Record browser interactions as video using Playwright. Use for capturing demo videos, app walkthroughs, and UI flows for Remotion videos. Triggers include recording a demo, capturing browser video, screen recording a website, or creating walkthrough footage.
qa/e2e-playwright
Playwright E2E 测试完整方法论，涵盖项目初始化、Page Object Model、认证复用、API Mock、视觉回归、多浏览器测试、CI 集成和调试技巧.
agent-browser
Automates browser interactions for web testing, form filling, screenshots, and data extraction. Use when the user needs to navigate websites, interact with web pages, fill forms, take screenshots, test web applications, or extract information from web pages.
browser-trace
Capture a full DevTools-protocol trace of any browser automation — CDP firehose, screenshots, and DOM dumps — then bisect the stream into per-page searchable buckets. Use when the user wants to debug a failed run, audit network/console/DOM activity, attach a trace to an in-progress session, or feed structured per-page…
ultimate-browsing
Escalation skill for blocked or hard-to-reach web access — load it when a normal browse/fetch is blocked (WAF, 403, Cloudflare, JS-only render, login-gated, or a platform a generic fetcher cannot read). Tiered router: TIER 1 insane-search (headless extraction + WAF bypass via curlcffi TLS impersonation, yt-dlp, Jina…