Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/wecode-ai/wegent/create-smart-appnpx skills add wecode-ai/Wegent --skill create-smart-appgit clone --depth 1 https://github.com/wecode-ai/WegentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/wecode-ai/wegent/create-smart-app)<a href="https://agentmods.dev/skills/wecode-ai/wegent/create-smart-app"><img src="https://agentmods.dev/badge/skills/wecode-ai/wegent/create-smart-app.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00043 | $0.00920 |
| Opus 5 | $0.00022 | $0.00460 |
| Sonnet 5 | $0.00009 | $0.00184 |
| Haiku 4.5 | $0.00004 | $0.00092 |
Grade A, and why
create-smart-app scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 76 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Create a Wework Smart app
Use this workflow when the user wants to build, modify, test, add plugins to, or package a Wework Smart app. A Smart app is an external DeepSeek Harness plugin bundle; never modify the DeepSeek Harness source tree to add the app.
Contract
- Keep the Smart app in the user's workspace or a directory they explicitly chose.
- When Wework supplies an existing Smart app directory, treat it as the durable project. Inspect and edit it in place; never replace it with a new scaffold.
- Pin the DSH version in
plugin-manifest.jsonand package dependencies. - Treat Wework's selected model as the runtime model. Do not bake model credentials into the package.
- A distributable ZIP must contain
plugin-manifest.json,PLUGIN.md,INSTALL.zh-CN.md, the profile bundlecordis.patch.yml, source, and built output. - Installation into Wework always ends with the native preview and model-selection confirmation. Do not bypass that confirmation by editing Wework data files.
Workflow
- Establish the app purpose, input/output, workspace directory, and target DSH
version. Default to the DSH version bundled by the current Wework build. If the
directory already contains
plugin-manifest.json, read the existing package, dependencies, source, andcordis.patch.ymlbefore proposing changes. - Run the bundled helper's
doctorcommand. Fix missing Node 22+ or Corepack/pnpm before creating files. - Search the DSH ecosystem with the helper's
searchcommand and, when visual inspection helps, use the Wework built-in browser to inspect thedsh-pluginGitHub topic and candidate repositories. Record chosen package names and exact versions. - Create the external package workspace only when it does not already exist.
Wework's blank Web preset is already a valid profile bundle. Reuse compatible
DSH plugins where possible; add them incrementally to the package declarations
and
cordis.patch.yml, and write only the capability-specific Host/Web code that is still missing. - Build and test the package. Use the DSH CLI to install the local profile bundle,
inspect
--dump-config, and launch the profile on an available loopback port. - Open that loopback URL in the Wework built-in browser. Verify the primary flow, one invalid-input path, and recovery. Save screenshots when the user requests evidence.
- Run the helper's
validatecommand after every change. Usepackonly when the user needs a distributable ZIP. Never packagenode_modules, credentials,.env, test output, or VCS metadata. - For a Wework-linked directory, return to 应用 → 智能工作台 → 我的 and refresh; the same workbench remains linked to the edited folder. For a ZIP-only workflow, use the native preview and model-selection confirmation before install.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 76 lines · 43 tokens per session scan A b0d6903e6a66
create-smart-app is a skill published in the GitHub repository wecode-ai/Wegent (776 stars, last pushed today), licensed Apache-2.0. It adds 43 tokens to every session and 920 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
develop-web-game
Use when Codex is building or iterating on a web game (HTML/JS) and needs a reliable development + testing loop: implement small changes, run a Playwright-based test script with short input bursts and intentional pauses, inspect screenshots/text, and review console errors with rendergametotext.
ha-browser
Hope Agent browser automation — the standard status → tabs → snapshot → act loop, stale-ref recovery rules, and what to do when login / 2FA / captcha / camera-prompt / dialog blocks progress. Load this skill whenever you reach for the browser tool. Trigger on: user asks the agent to open / control / click / scrape /…
web-search
Real-time web search using Playwright-controlled browser. Use this skill when you need current information, latest documentation, recent news, or any data beyond your knowledge cutoff (January 2025).
web-access
复杂 web 任务的方法论与跨 session 站点经验库。Use when：抓取反爬或需登录态的平台（小红书、微信公众号、微博、推特、知乎等）、 目标站点结构未知需要边看边探索、多来源交叉核实信息、分析页面里的图片/视频内容、并行调研多个独立来源、 或 websearch/webfetch 拿不到目标内容需要升级到真实浏览器时。 简单的已知 URL 抓取或单步页面操作（无登录/反爬因素）不需要加载本 skill——直接用 webfetch / browser 工具即可。.
in-app-browser
Proma 内嵌受管浏览器使用指南。当用户要求打开、展示、访问、浏览或操作网页，或提到小红书、X/Twitter、LinkedIn、BOSS 直聘、登录后站内搜索、动态页面、截图或本地 HTML/React 预览时使用。对邮件、消息、文档、项目管理等已有匹配专用 MCP/API/CLI 的服务，必须优先使用专用工具；仅在没有匹配工具、工具无法完成当前能力、网络搜索工具不可用或无法取得足够好的结果、或用户明确要求网页时改用 Browser。浏览器工具出现在当前工具列表时，必须先阅读本 Skill 再进行网页操作；不要因为工具直接可见就跳过。.
playwright
Use when the task requires automating a real browser from the terminal (navigation, form filling, snapshots, screenshots, data extraction, UI-flow debugging) via playwright-cli or the bundled wrapper script.