Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add tonydzi/second-brain-starter-kit --skill dr-fanoutgit clone --depth 1 https://github.com/tonydzi/second-brain-starter-kitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tonydzi/second-brain-starter-kit/dr-fanout)<a href="https://agentmods.dev/skills/tonydzi/second-brain-starter-kit/dr-fanout"><img src="https://agentmods.dev/badge/skills/tonydzi/second-brain-starter-kit/dr-fanout/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tonydzi/second-brain-starter-kit/dr-fanout"><img src="https://agentmods.dev/badge/skills/tonydzi/second-brain-starter-kit/dr-fanout.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high YARA Match · line 17 YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).Fix: Remove the malware payload or compromised file entirely. Investigate how it entered the skill and audit all other artifacts for additional indicators of compromise.
- high Data Exfiltration · line 81 Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.Fix: Remove any code that sends prompts, responses, or session data externally. Preserve user privacy; never exfiltrate conversation content.
- medium Excessive Agency · line 34 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Excessive Agency · line 153 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00083 | $0.11812 |
| Opus 5 | $0.00042 | $0.05906 |
| Sonnet 5 | $0.00017 | $0.02362 |
| Haiku 4.5 | $0.00008 | $0.01181 |
Grade A, and why
dr-fanout scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
1. **🔑 PROMPT TRANSPORT = `window.name`, not inline in javascript_tool.** A 12 KB prompt inlined for three vendors = ~37 KB of context plus an escaping risk. The working path, 0 tokens: `navigate` the tab to a local fil How it starts
The opening of the file, as written. The whole thing — 175 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/dr-fanout — fan a Deep Research prompt out to 3+ LLMs and collect a consensus
The final stage of the Alpha Protocol, automated. Channels: ChatGPT (chatgpt.com) · Gemini (gemini.google.com) · Grok (grok.com). The mechanism = the Claude-in-Chrome MCP (the operator's live logged-in Chrome). Canon: [[alpha-protocol-recall-plus-dr]], decision-multi-llm-vendor-independence (heterogeneous consensus), [[chrome-autonomy-self-drive]], [[browser-work-on-peers-not-hub]] (strictly local).
⭐ What is already decided (the foundation, don't re-research) — updated 2026-07-16
- The browser layer = Firefox-first (Decision Memo
02-Decisions/decision-2026-07-16-browser-automation-layer.md, DR26-07-16-HUB-01, confidence high). Chrome 127+ encrypts cookies (ABE) and since April 2026 binds sessions to the hardware (DBSC) → external cookie extraction is impossible without malware techniques. Firefox cookies are open (plaintext SQLite, DBSC not implemented) → a dedicated per-service Firefox profile + Playwrightlaunch_persistent_context; a Chrome CDP attach is only a fallback for strictly-Chromium sites. The hub stack is already up:firefox_cookies.py(~/.claude/scripts/_shared/), profiles in<AUTOMATION_BROWSERS_ROOT>\Firefox\. - The live Chrome MCP (Claude-in-Chrome) remains the deliberate anti-ban path for actions that must look like "a human in a real session" (fb-post/x-post go that way). For dr-fanout the choice of execution path (live Chrome MCP vs headless Firefox+Playwright) is being clarified by an ongoing DR (see item 4).
- A CLI workaround does NOT give you subscription Deep Research (verified 07-15): the Codex CLI / Gemini CLI only do web search; real consumer-subscription Deep Research cannot be triggered programmatically (Google's DR agent = a separate paid API). ⇒ the browser front end is the only road to subscription DR, so we make it anti-fragile instead of running away from it.
- ToS risk, sharpest at Grok: the xAI AUP explicitly forbids automated/non-human access (risk of suspension/termination). There are no documented bans for automating YOUR OWN account, but the text is explicit → run the Grok channel at human pace; the decision to "keep / slow down / replace with claude.ai" belongs to the owner.
- Grok — we simply keep using it (the owner's decision, 2026-07-16). The xAI AUP formally forbids automation, but enforcement hunts mass scraping (a $15k/1M-requests penalty), and our pace is naturally tiny (a few DRs per day at most) → we are not the target. The value of a third independent voice > the managed risk. Do NOT build limiters/throttling ([[ak47-simplicity]]) — Grok stays in the normal rotation; if the vendor itself pushes back (a captcha/challenge) — report it and skip that channel, no drama.
- The execution path is HYBRID, per vendor (the owner's decision, 2026-07-16, "both ways"). Not one method for everyone:
Vendor Path Why Grok live Chrome MCP, human pace ToS-sensitive → act like a human in a real session (maximum anti-ban, same as fb-post [[chrome-autonomy-self-drive]]); a headless bot here = maximum risk ChatGPT a dedicated headless Firefox profile (unattended) OR the live Chrome MCP milder ToS; report extraction = backend JSON (works in both); for an unattended schedule → Firefox Gemini a dedicated headless Firefox profile (unattended) two-phase (plan → Start research), tolerant of automation; candidate #1 for a fully unattended run The principle: the harsher a vendor's ToS / ban sensitivity → the closer to "a live human in a session" (Chrome MCP); the more tolerant it is + the more unattended operation matters → the closer to a dedicated Firefox profile (Playwright persistent, the HUB-01 foundation). - ✅ The orchestration is CONFIRMED by an external DR (
DR26-07-14-FLEE-01, a ChatGPT+Grok synthesis 2026-07-16, digest in03-Insights/insight-DR-DR26-07-14-FLEE-01-*). Both vendors independently: the core = a durable state machine + a job ledger, NOT "a long-lived autonomous browser agent"; a local ledger FSM is sufficient for a single-owner hub. Both independently advise NOT to build unattended Grok automation (the xAI AUP + enforcement is real: >52k bans in 2026, Reuters 07-15) → our matrix in item 6 already honours that (Grok only via live Chrome MCP, never in a daemon). Start the unattended schedule with 2 vendors: ChatGPT + Gemini. - Keep the vendor logic THIN and the orchestration SHARED. UI-specific repos die fast (
chatgpt-automation-mcparchived 2026-04-27,browserbase/gemini-browserarchived 2026-05-20). Everything vendor-specific = swappable "adapters" at the bottom; the state machine/ledger above them does not change. - ⚠️ OPEN — the official path for Gemini: the Deep Research Agent / Interactions API (
background=True+ polling, collaborative_planning) — production-ready, and it removes the most fragile and slowest browser channel. BUT ⚠️ ADDED COMPLEXITY + unclear billing: is it included in the Ultra subscription or is it separate money (the ChatGPT report says "NOT the same free-with-subscription")? Check the billing BEFORE building ([[prefer-included-limits-before-paid-api]]) — if it is paid, don't set it up without the owner's "+".
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +1 lines · -15 tokens per session fe60d503eb4e
- 9d ago First seen · 174 lines · 98 tokens per session scan A da98688dbe7e
dr-fanout is a skill published in the GitHub repository tonydzi/second-brain-starter-kit (6 stars, last pushed today), licensed MIT. It adds 83 tokens to every session and 11,812 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
defuddle
Plan and, with explicit network consent, use an optional external Defuddle cleaner to extract article-like HTTPS pages as Markdown. Use for defuddle, clean this URL, strip page clutter, readable Markdown from a web page, or preparing a web source for later wiki ingestion.
wiki-ingest
Ingest supplied source material into an Obsidian vault with provenance and claim tracking: pasted text, files staged in the selected vault's inbox or .raw archive, or explicitly approved URLs. Use for a single source or bounded batch, not for saving an assistant answer. Triggers: ingest, ingest this file, ingest this…
autoresearch
Run a bounded, source-grounded research loop, draft a cited dossier, and optionally propose a separately reviewed canonical vault merge. Use when the user wants autonomous or deep research that may access the public web. Triggers: /autoresearch, autoresearch, research this topic, deep dive into, investigate, find…
wiki-retrieve
Build and query a vault-local contextual BM25 retrieval index with optional multilingual Nomic cosine reranking; use for retrieve, hybrid retrieval, BM25, rerank, contextual retrieval, chunk search, vault search, semantic search, find relevant passages, or retrieval diagnostics. Derived caches stay under .vault-meta…
canvas
Create, inspect, and update Obsidian JSON Canvas boards with text, file, link, group, and edge nodes. Use for canvas status, canvas lists, visual maps, zones, spatial layouts, adding vault notes or media to a .canvas file, and requests such as create canvas, add to canvas, or put this on the canvas.
obsidian-bases
Explain, draft, and validate Obsidian Bases .base files with filters, formulas, properties, summaries, and table, card, or list views. Use for Obsidian Bases, database-like vault views, dynamic tables, reading lists, task trackers, filters, formulas, summaries, and .base file edits.