Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add tranfu-labs/tranfu-skills --skill social-media-login-collectorgit clone --depth 1 https://github.com/tranfu-labs/tranfu-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tranfu-labs/tranfu-skills/social-media-login-collector)<a href="https://agentmods.dev/skills/tranfu-labs/tranfu-skills/social-media-login-collector"><img src="https://agentmods.dev/badge/skills/tranfu-labs/tranfu-skills/social-media-login-collector/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tranfu-labs/tranfu-skills/social-media-login-collector"><img src="https://agentmods.dev/badge/skills/tranfu-labs/tranfu-skills/social-media-login-collector.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00125 | $0.01739 |
| Opus 5 | $0.00063 | $0.00870 |
| Sonnet 5 | $0.00025 | $0.00348 |
| Haiku 4.5 | $0.00013 | $0.00174 |
Grade A, and why
social-media-login-collector scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 107 lines — stays where its author put it; the contents beside it link to each section on GitHub.
社媒登录采集器
安全边界
只执行用户明确要求的只读采集。让用户亲自完成扫码、密码、短信、OTP、验证码和设备确认。不得读取、打印、复制或保存 Cookie、Token、认证头、手机号、验证码、密码、localStorage、sessionStorage 和认证文件。
只使用 browser:control-in-app-browser Skill 控制 Codex 内置浏览器，并在任何浏览器动作前完整读取该 Skill。复用当前浏览器配置和登录态；不得切换到外部浏览器、独立 Playwright、代理、伪装指纹或其他控制机制。
不得发文、删除、关注、取关、点赞、评论、私信、修改设置、购买服务或开启试用。不得调用隐藏接口、重放 XHR、构造分页 URL、清理浏览器存储或自动切换账号。
严格串行执行：同一时间只操作一个平台、一个账号、一个标签页。不要添加随机“真人化”动作或无证据的固定等待；每次动作后等待页面可见状态稳定。
选择模式
- 默认一次采集一个平台；用户说“采集全部平台”时按微信、小红书、知乎、头条、微博顺序执行。
- 默认范围为
Asia/Shanghai时区内截至昨天的 30 个完整自然日。用户指定范围时使用用户范围；平台无法精确选择时记录实际范围并标记partial。 - 同一批多平台采集共用一个安全的
run-id。 - 当当前目录或父目录同时满足以下条件时启用看板模式：
package.json.name为social-media-analytics-app- 存在
lib/import/parsers.ts - 存在
scripts/import-social-data.ts
- 其他情况使用通用模式，输出到
<cwd>/output/social-collections/<run-id>/<platform>/。
开始采集前读取 manifest-schema.md。看板模式再读取 dashboard-adapter.md。只读取当前平台的 reference：
- 微信：wechat.md
- 小红书：xiaohongshu.md
- 知乎：zhihu.md
- 头条：toutiao.md
- 微博：weibo.md
执行流程
- 连接 Codex 内置浏览器并优先复用当前官方后台标签页；没有合适标签页时只打开 reference 中的官方入口。
- 检查登录状态。未登录时显示浏览器并让用户完成登录，然后结束当前回复，等待用户确认“已登录”。
- 登录后确认账号名称。存在多个账号且当前账号不明确时，让用户选择；不得自动切换。
- 通过可见菜单进入数据页并选择日期范围。每个所需数据模块最多执行一次平台原生导出，使用结构化表格解析器检查文件签名、表头、日期和行数；不要把“已下载”当作“已采集完成”。
- 原生下载不可用时，只使用当前平台 reference 中最少交互的可见数据回退。定位失败最多重新读取一次 DOM 快照；分页只点击可见“下一页”，页码不前进、首尾记录重复或日期越界时立即停止。
- 建立标准 manifest。只保留 reference 列出的指标字段；不得保存整页 DOM、iframe URL、网络请求、脚本状态或未知页面对象。后台
source_url只写https://host/path，删除 query、fragment 和 userinfo。 - 按 manifest 契约完成日期覆盖、必采指标、来源、内容唯一性和平台汇总对账。只有唯一算术关系可产生派生值，并标记
method: derived、confidence: derived。 - 使用 bundled Python 运行通用导出：
<bundled-python> {baseDir}/scripts/export_collection.py --manifest <manifest.json>
使用 codex_app__load_workspace_dependencies 获取 <bundled-python>；不要硬编码本机运行时路径。后续只使用导出器生成并带哈希报告的 collection.json。
What ships with it
15 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- agents/openai.yaml 387 B
- assets/icon.png 915 B
- assets/icon.svg 533 B
- README.md 7.4 KB
- README.zh.md 6.3 KB
- references/dashboard-adapter.md 2.6 KB
- references/manifest-schema.md 5.1 KB
- references/toutiao.md 1.4 KB
- references/wechat.md 1.8 KB
- references/weibo.md 1.7 KB
- references/xiaohongshu.md 1.6 KB
- references/zhihu.md 1.2 KB
- scripts/build_dashboard_exports.mjs 24 KB runs code
- scripts/export_collection.py 28 KB runs code
- scripts/self_test.py 21 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 107 lines · 125 tokens per session scan A 626acae77c09
social-media-login-collector is a skill published in the GitHub repository tranfu-labs/tranfu-skills (2 stars, last pushed 2d ago), licensed MIT. It adds 125 tokens to every session and 1,739 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
debug-optimize-lcp
Guides debugging and optimizing Largest Contentful Paint (LCP) using Chrome DevTools MCP tools. Use this skill whenever the user asks about LCP performance, slow page loads, Core Web Vitals optimization, or wants to understand why their page's main content takes too long to appear. Also use when the user mentions…
opencli-sitemap-author
Use when creating or maintaining OpenCLI site sitemaps: agent-facing navigation, page-state, action, workflow, API-reference, pitfall, and fallback knowledge for a website. Use after browser exploration discovers durable site context, when a sitemap is stale, or when promoting local site knowledge into the repo.
interactive-login
How to complete browser/interactive logins (aws / gh / glab / gcloud). The platform backgrounds the login poller so it survives the human's browser round-trip — and when that does NOT work.
pinchtab-mcp
Use this skill when a task requires browser automation through PinchTab's MCP server connected to a remote browser instance. Covers navigation, element interaction, data extraction, form filling, multi-step flows, and session management via MCP tools.
azure-messaging-webpubsub-java
Build real-time web applications with Azure Web PubSub SDK for Java. Use when implementing WebSocket-based messaging, live updates, chat applications, or server-to-client push notifications.
google-safe-browsing
Prevent and fix Google Safe Browsing "Dangerous site" flags. Use when launching a public web app, buying/picking a domain, building a login or signup page, or when any site shows a red "Dangerous site" / "Deceptive site" warning in Chrome, Brave, Safari, Firefox, or Edge. Triggers on "dangerous site", "deceptive…