Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add taxueseek/argo --skill js-rungit clone --depth 1 https://github.com/taxueseek/argoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/taxueseek/argo/js-run)<a href="https://agentmods.dev/skills/taxueseek/argo/js-run"><img src="https://agentmods.dev/badge/skills/taxueseek/argo/js-run/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/taxueseek/argo/js-run"><img src="https://agentmods.dev/badge/skills/taxueseek/argo/js-run.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00182 | $0.00863 |
| Opus 5.5 | $0.00073 | $0.00345 |
| Sonnet 5.5 | $0.00036 | $0.00173 |
| Haiku 4.5 | $0.00018 | $0.00086 |
Grade A, and why
js-run scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
js-run（argo 子技能，v0 骨架）
一句话：给 HTML 与资源，还你 JS 算完的结果——不开浏览器。
它解决什么
网页 JS 依赖浏览器环境（navigator/document/crypto…）时，传统上只有两条路：
开真浏览器（秒级、百 MB、重）或放弃。js-run 把「浏览器环境的 JS 语义」做成库：
V8 执行 + 环境垫片，单次上下文 P50 ≈ 1ms，逻辑时间让 setTimeout(5000) 瞬间完成。
v0 明确不做什么
| 不做 | 原因 | 归属 |
|---|---|---|
| DOM 解析/布局 | v0 面只保「探测+计算」型脚本 | 后续按考卷生长 |
| 真实网络请求 | 它一个字节都不取，取数归 HTTP 车道 | argo 前两级 |
| 登录态/指纹连续性 | 合成环境无会话可继承 | ego-search |
| 截图/视觉 | 无布局引擎 | ego-browser |
用法
import sys; sys.path.insert(0, "sub-skills/js-run/scripts")
from jsrun import JsRun
with JsRun() as jr:
jr.run(open("challenge.js").read()) # 跑目标脚本
jr.advance(3000) # 逻辑时间推进
cookie = jr.get_cookie() # 收通行证
python3 tests/test_jsrun.py # 7 项金标测试（含速度门 <100ms，实测 P50 1.0ms）
依赖
mini-racer（ISC，V8 绑定）：pip install mini-racer- 无其他第三方依赖；Python ≥ 3.10
纪律
- 产物只当线索不当正文：网络数据在垫片里没有真源，页面 JS 拿到的任何 「网络响应」都不可信；需要数据必须 Python 侧真取。
- 反爬对抗谨慎：本车道用于已授权/自有场景的通行证计算；对第三方站点的 挑战绕过默认关闭，启用须单独拍板。
- 考卷驱动生长：环境面只按 tests/fixtures/ 里的真实考卷长，不为想象中的 浏览器写代码（详见 docs-local 设计文档）。
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 66 lines · 182 tokens per session scan A cbcf267e7212
js-run is a skill published in the GitHub repository taxueseek/argo (194 stars, last pushed yesterday), licensed MIT. It adds 182 tokens to every session and 863 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-05.
Other skills, from other repositories
pentest-playbook
A penetration-testing playbook for examining authorized websites, applications, and services for real, verified security weaknesses.
browser-skill
Automate the user's logged-in Chromium browser: read pages, fill forms, scrape data, operate tabs, test a UI, or debug a website. Requires the bsk CLI and browser extension.
lingshu-browser
A routing guide for browser and web-development topics, including rendering, the DOM, event loops, web storage, content security, performance, and progressive web apps. It directs a task to a more specific unit when needed.
browser-440d4398
A browser popup controller that allows popups started by a user action and blocks and records automatic popups.
browser-02898b15
A narrowly targeted browser skill for event bubbling, where a browser event travels from the element that received it up through its parent elements. It is intended only when the task explicitly concerns this event path.
browser-0754386d
A guide to the browser Fetch API, which sends network requests with a method, URL, headers, and optional body.