Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add youdotcom-oss/agent-skills --skill you-webgit clone --depth 1 https://github.com/youdotcom-oss/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/youdotcom-oss/agent-skills/you-web)<a href="https://agentmods.dev/skills/youdotcom-oss/agent-skills/you-web"><img src="https://agentmods.dev/badge/skills/youdotcom-oss/agent-skills/you-web/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/youdotcom-oss/agent-skills/you-web"><img src="https://agentmods.dev/badge/skills/youdotcom-oss/agent-skills/you-web.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Data Exfiltration · line 7 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 22 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 38 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00028 | $0.00940 |
| Opus 5 | $0.00014 | $0.00470 |
| Sonnet 5 | $0.00006 | $0.00188 |
| Haiku 4.5 | $0.00003 | $0.00094 |
Grade A, and why
you-web scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 80 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You.com Web MCP
Use You.com MCP tools when the answer depends on current web information, source comparison, cited synthesis, or reading specific URLs.
Prerequisites
The You.com MCP server must be installed and connected before using this skill:
- Server URL:
https://api.you.com/mcp - Auth: either
YDC_API_KEYbearer auth, OAuth login into the server, or an x402-aware MCP client that can process402 payment-requiredchallenges - Required tools:
you-search,you-contents, andyou-research
For bearer auth, configure the host MCP client with an authorization header equivalent to:
{
"Authorization": "Bearer ${YDC_API_KEY}"
}
If auth is not available and the client is not x402-aware, use the you-free skill for basic search.
MCP server
Use the You.com MCP server at https://api.you.com/mcp. The normal setup is YDC_API_KEY bearer auth or OAuth login. x402-aware clients can receive upstream payment challenges and retry search or contents calls through MCP with payment headers.
Before using this skill, check the MCP tools available in the current agent environment:
- If
you-search,you-contents, andyou-researchare available, use them directly. - If the server or required tools are missing, tell the user which capability is missing, provide the server URL and auth options from the prerequisites above, and request approval before installing, connecting, or changing MCP configuration.
- Do not invent MCP commands for the host. Use the host's installed MCP tool interface.
x402 payment behavior
- The MCP server forwards payment retry headers upstream:
Authorization: Payment ...,x-payment, andpayment-signature. - For
you-search,you-contents, and the corresponding REST endpoints, use x402 payment challenges only. - If a search or contents tool call returns HTTP
402withpayment-required, let the MCP client handle payment externally and retry. Do not treat that response as a final answer. - Research and finance endpoints have broader MPP/x402 support; use the
you-researchoryou-financeskill for those flows. - For keyless payment with no API key and no manual signing, compose the You.com MCP server with the Coinbase Payments MCP server so the host handles payment; see Coinbase Payments MCP path.
- Account balance is private billing data; do not access balance endpoints through keyless payment flows.
- Do not implement wallet signing or payment settlement inside this skill. Use the host MCP client's x402 flow.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 80 lines · 28 tokens per session scan A 085e4ab2c548
you-web is a skill published in the GitHub repository youdotcom-oss/agent-skills (67 stars, last pushed 8d ago), licensed MIT. It adds 28 tokens to every session and 940 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
openclaw-web-scraper
Stealth web scraping MCP server with 5 tools for structured data extraction. Use when: (1) 'scrape this URL' or 'extract data from this site', (2) 'get all prices from this page' or 'extract structured data', (3) 'take a screenshot of this page', (4) 'click this button and get the result' or 'interact with a page'…
a11y-debugging
Uses Chrome DevTools MCP for accessibility (a11y) debugging and auditing based on web.dev guidelines. Use when testing semantic HTML, ARIA labels, focus states, keyboard navigation, tap targets, and color contrast.
chrome-devtools
Uses Chrome DevTools via MCP for efficient debugging, troubleshooting and browser automation. Use when debugging web pages, automating browser interactions, analyzing performance, or inspecting network requests. This skill does not apply to --slim mode (MCP configuration).
debug-optimize-lcp
Guides debugging and optimizing Largest Contentful Paint (LCP) using Chrome DevTools MCP tools. Use this skill whenever the user asks about LCP performance, slow page loads, Core Web Vitals optimization, or wants to understand why their page's main content takes too long to appear. Also use when the user mentions…
memory-leak-debugging
Diagnoses and resolves memory leaks in JavaScript/Node.js applications. Use when a user reports high memory usage, OOM errors, or wants to capture, compare, or inspect heap snapshots with Chrome DevTools MCP memory tools.
assets-get-data
Get asset data from the asset file in the Unity project — every serializable field and property. Supports token-saving path-scoped reads via paths or viewQuery. Use 'assets-find' to find the asset first.