Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/starrycod/cogitum/macos-computer-usenpx skills add StarryCod/cogitum --skill macos-computer-usegit clone --depth 1 https://github.com/StarryCod/cogitumWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00060 | $0.01821 |
| Opus 5 | $0.00030 | $0.00911 |
| Sonnet 5 | $0.00012 | $0.00364 |
| Haiku 4.5 | $0.00006 | $0.00182 |
Grade F, and why
macos-computer-use scanned grade F with 4 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
`sudo rm -rf`, etc.). Break the command up or reconsider. Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
that matches the dangerous-pattern block list (`curl ... | bash`, Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
`sudo rm -rf`, etc.). Break the command up or reconsider. Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
that matches the dangerous-pattern block list (`curl ... | bash`, Copies of this mod
1 near-identical copy found in the catalogue:
- macos-computer-use — 89% identical, 15 lines differ
How it starts
The opening of the file, as written. The whole thing — 205 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Requires macOS
macOS Computer Use (universal, any-model)
You have a computer_use tool that drives the Mac in the background.
Your actions do NOT move the user's cursor, steal keyboard focus, or switch
Spaces. The user can keep typing in their editor while you click around in
Safari in another Space. This is the opposite of pyautogui-style automation.
Everything here works with any tool-capable model — Claude, GPT, Gemini, or an open model running through a local OpenAI-compatible endpoint. There is no Anthropic-native schema to learn.
The canonical workflow
Step 1 — Capture first. Almost every task starts with:
computer_use(action="capture", mode="som", app="Safari")
Returns a screenshot with numbered overlays on every interactable element AND an AX-tree index like:
#1 AXButton 'Back' @ (12, 80, 28, 28) [Safari]
#2 AXTextField 'Address and Search' @ (80, 80, 900, 32) [Safari]
#7 AXLink 'Sign In' @ (900, 420, 80, 24) [Safari]
...
Step 2 — Click by element index. This is the single most important habit:
computer_use(action="click", element=7)
Much more reliable than pixel coordinates for every model. Claude was trained on both; other models are often only reliable with indices.
Step 3 — Verify. After any state-changing action, re-capture. You can save a round-trip by asking for the post-action capture inline:
computer_use(action="click", element=7, capture_after=True)
Capture modes
mode |
Returns | Best for |
|---|---|---|
som (default) |
Screenshot + numbered overlays + AX index | Vision models; preferred default |
vision |
Plain screenshot | When SOM overlay interferes with what you want to verify |
ax |
AX tree only, no image | Text-only models, or when you don't need to see pixels |
Actions
capture mode=som|vision|ax app=… (default: current app)
click element=N OR coordinate=[x, y]
double_click element=N OR coordinate=[x, y]
right_click element=N OR coordinate=[x, y]
middle_click element=N OR coordinate=[x, y]
drag from_element=N, to_element=M (or from/to_coordinate)
scroll direction=up|down|left|right amount=3 (ticks)
type text="…"
key keys="cmd+s" | "return" | "escape" | "ctrl+alt+t"
wait seconds=0.5
list_apps
focus_app app="Safari" raise_window=false (default: don't raise)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 205 lines · 60 tokens per session scan F 4b9cb0a356b0
macos-computer-use is a skill published in the GitHub repository StarryCod/cogitum (11 stars, last pushed 3mo ago), licensed MIT. It adds 60 tokens to every session and 1,821 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it F with 4 findings (asks for root, downloads and executes remote code, recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ppt-generation
Use this skill when the user requests to generate, create, or make presentations (PPT/PPTX). Creates visually rich slides by generating images for each slide and composing them into a PowerPoint file.
newsletter-generation
Use this skill when the user requests to generate, create, write, or draft a newsletter, email digest, weekly roundup, industry briefing, or curated content summary. Supports topic-based research, content curation from multiple sources, and professional formatting for email or web distribution. Trigger on requests…
smoke-test
End-to-end smoke test skill for DeerFlow. Guides through: 1) Pulling latest code, 2) Docker OR Local installation and deployment (user preference, default to Local if Docker network issues), 3) Service availability verification, 4) Health check, 5) Final test report. Use when the user says "run smoke test", "smoke…
data-analysis
Use this skill when the user uploads Excel (.xlsx/.xls) or CSV files and wants to perform data analysis, generate statistics, create summaries, pivot tables, SQL queries, or any form of structured data exploration. Supports multi-sheet Excel workbooks, aggregation, filtering, joins, and exporting results to…
podcast-generation
Use this skill when the user requests to generate, create, or produce podcasts from text content. Converts written content into a two-host conversational podcast audio format with natural dialogue.
github-deep-research
Conduct multi-round deep research on any GitHub Repo. Use when users request comprehensive analysis, timeline reconstruction, competitive analysis, or in-depth investigation of GitHub. Produces structured markdown reports with executive summaries, chronological timelines, metrics analysis, and Mermaid diagrams.…