Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/thevibeworks/deva/deva-cloaknpx skills add thevibeworks/deva --skill deva-cloakgit clone --depth 1 https://github.com/thevibeworks/devaWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00123 | $0.02785 |
| Opus 5 | $0.00062 | $0.01392 |
| Sonnet 5 | $0.00025 | $0.00557 |
| Haiku 4.5 | $0.00012 | $0.00279 |
Grade A, and why
deva-cloak scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 228 lines — stays where its author put it; the contents beside it link to each section on GitHub.
deva-cloak: stealth browser in the deva cloak container
CloakBrowser is a custom-compiled Chromium with source-level fingerprint patches. Same Playwright API, different binary -- detection sites score it as a real browser because it is one. This image runs it headed by default on a virtual display, which passes checks that headless fails even with the patches.
Am I in the cloak context?
This skill only applies when the browser is actually present. ALWAYS run
this check fresh -- never conclude from conversation context, a resumed
session, or $DEVA_CLOAK alone (env markers can be scrubbed or stale;
the binary is the ground truth):
command -v cloakbrowser >/dev/null && cloakbrowser info --quick
If that fails, you are in the base or rust image -- there is no CloakBrowser
here. (DEVA_CLOAK=1 is baked into the cloak image as a convenience marker,
but treat it as a hint, not the test.) Tell the user to relaunch with
deva.sh -p cloak <agent>, or use the plain Playwright install (rust image)
instead. Do not try to npm install cloakbrowser yourself; the binary is
baked into the cloak image and a runtime install would download ~200MB and
defeat the point.
What is baked in
- Wrapper +
playwright-corelive in$CLOAK_APP_DIR(/opt/cloak). - Chromium binary is pre-downloaded, cache at
/opt/cloakbrowser, auto-update off -- fully offline, no network needed to launch. - Free binary = Chromium 146 (58 fingerprint patches). No Pro license.
Good enough for most sites and for viewing your own apps; the newest
detection tricks (latest Cloudflare/DataDome) may still win. Pro (146->150,
71 patches) needs
CLOAKBROWSER_LICENSE_KEYat runtime -- no rebuild. - Headed display: Xvfb on
:99+ openbox, started by the entrypoint. x11vncfor VNC into that display (interactive logins). Start it on demand (x11vnc -display :99 -rfbport 5900 -bg); on OrbStack/Linux the Mac reaches it directly at the container IP -- no port publish, no launch flag.cloak-browserdalways-on browser daemon (/usr/local/lib/cloak/cloak-browserd.mjs); OPT-IN, runs only with--cloak-browser, exposes CDP atCLOAK_CDP_ENDPOINT. Independent of VNC.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 228 lines · 123 tokens per session scan A 9794d881c015
deva-cloak is a skill published in the GitHub repository thevibeworks/deva (13 stars, last pushed 5d ago), licensed MIT. It adds 123 tokens to every session and 2,785 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
harbor
CLI toolkit for managing containerized LLM services. Use when the user wants to start, stop, configure, or manage AI/LLM services like Ollama, Open WebUI, llama.cpp, vLLM, LiteLLM, ComfyUI, and 250+ others. Triggers on requests to "run a model", "start ollama", "set up an LLM", "configure harbor", "manage services"…
project-writing-collectors
Best practices and orientation for AI assistants authoring or modifying Netdata data-collection plugins or modules in any language. Read before adding a new collector, modifying an existing one, working on logs, topology, NetFlow/sFlow/IPFIX, OTEL ingestion, SNMP profiles, statsd, Prometheus scraping, or interactive…
temps
Manage, deploy, operate, and instrument applications with Temps. Use this skill whenever the user mentions Temps, @temps-sdk/[email protected], deploying or migrating an app to Temps, projects, environments, services, domains, backups, logs, monitoring, analytics, browser Performance Insights/Core Web Vitals, observability…
neo4j-nvl-skill
Neo4j Visualization Library (NVL) — framework-agnostic graph rendering for the browser. Covers @neo4j-nvl/base (NVL class, nodes/relationships, Canvas vs WebGL renderer), @neo4j-nvl/interaction-handlers (ZoomInteraction, PanInteraction, DragNodeInteraction, ClickInteraction, HoverInteraction, BoxSelectInteraction…
lov-app-generator
Use when the user asks for "App生成器", "生成 Web App", "生成 Tauri App", "生成原生 macOS App", "Finder Quick Action", "只创建 web", or to standardize an existing app with branding, CI/CD, native integration, and Lovinsp where applicable.
lov-integrate-lovinsp
幂等集成 lovinsp (click-to-code) 到当前前端项目，并支持从 code-inspector 自动迁移。 Use when the user asks to "装 lovinsp"、"集成 lovinsp"、"接入点击跳转源码"、"click to code"、 "从 code-inspector 迁移"，or when scaffolding/upgrading a browser-rendered app that needs click-to-source support. Also trigger when another skill (例如 lov-app-generator) requires…