Skills DirectorySkills Directory
SkillsLearnSecurityCategoriesDocsCommunityBlog
Sign InSubmit Skill
Skills Directory

Security-tested agent skills for Claude, coding agents, and AI workflows.

Directory

  • Browse Skills
  • All Skills A–Z
  • Claude Skills
  • Claude Code Skills
  • Agent Skills
  • Categories
  • Authors
  • Submit a Skill

Learn

  • Learn Hub
  • Install Claude Skills
  • Write SKILL.md
  • Skills vs MCP
  • Directories Compared

Security

  • Security
  • Methodology
  • Secure Claude Skills
  • Security Badges

Company

  • About
  • Community
  • Blog
  • API Docs
  • Advertise

2026 Skills Directory. All rights reserved.

ProTermsPrivacyRefunds
Back to skills

Webmcp Gen

ASecurity

Create, compile, and validate site-specific WebMCP init scripts from a target URL and desired tool capability. Use when the user wants to author WebMCP tools for a website, produce a webmcp.init.js artifact, or test WebMCP registration and invocation through Stagehand.

36 stars
0 votes
0 copies
0 views
Added 9/22/2026
toolsjavascripttypescriptjavabashnodetestingapi

Works with

cliapimcp

Security Analysis

A92/100
mediumInstalls packages at runtime which could introduce malicious dependencies

Scanned 9/22/2026

Install to Claude Code

$npx -y skills add NVlabs/Skill2Env --skill webmcp-gen --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Webmcp Gen?

Add the live security badge to your README — it updates automatically with every re-scan.

Security grade badge for Webmcp Gen
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/nvlabs-webmcp-gen/badge)](https://www.skillsdirectory.com/skills/nvlabs-webmcp-gen)

More formats (shields.io, HTML) on the badges page.

Download with Pro
Files
SKILL.md
---
name: webmcp-gen
description: Create, compile, and validate site-specific WebMCP init scripts from a target URL and desired tool capability. Use when the user wants to author WebMCP tools for a website, produce a webmcp.init.js artifact, or test WebMCP registration and invocation through Stagehand.
compatibility: "Requires Node 18+ and Chrome/Chromium with WebMCP testing flags. Run `pnpm install` in the skill directory to install the Stagehand dependency. Page exploration uses the browse CLI (`npm install -g browse`)."
license: MIT
allowed-tools: Bash Read Grep Edit Write
---

# WebMCP Gen

Author website-specific WebMCP tools by writing a manifest, compiling it to an init script, and validating that Chrome registers and invokes the tools.

This skill does not call a nested agent. You are responsible for exploring the page, writing `manifest.json`, and iterating based on validation output.

## Setup check

From the skill directory, install dependencies if they are not already installed:

```bash
cd skills/webmcp-gen
pnpm install
```

This installs the pinned Stagehand package plus the TypeScript toolchain (`tsx`,
`typescript`, `@types/node`) used to run the generated `stagehand-example.ts`.

## Workflow

1. Pick an artifact slug with exactly one slash:

```text
<domain>/<task>
```

Example:

```text
example.com/page-context
```

2. Scaffold the artifact:

```bash
node scripts/scaffold.mjs example.com/page-context --url https://example.com
```

3. Explore the target page with the `browse` CLI:

```bash
browse open https://example.com --local
browse snapshot
browse get title
browse get url
browse get text body
browse get html body
```

Prefer `browse snapshot`, page text, and DOM inspection over screenshots unless visual layout matters. Use `browse stop` when exploration is complete.

4. Edit `artifacts/<domain>/<task>/manifest.json`. The manifest is the source of truth.

5. Compile:

```bash
node scripts/compile.mjs artifacts/example.com/page-context
```

6. Generate a runnable Stagehand example (`stagehand-example.ts`) and run it with `tsx`:

```bash
node scripts/generate-stagehand-example.mjs artifacts/example.com/page-context
npx tsx artifacts/example.com/page-context/stagehand-example.ts
```

7. Validate:

```bash
node scripts/validate.mjs artifacts/example.com/page-context
```

8. If validation fails, inspect `eval.json` and `eval-report.md`, patch `manifest.json`, then compile and validate again.

## Manifest contract

```json
{
  "domain": "example.com",
  "task": "page-context",
  "url": "https://example.com",
  "generatedAt": "2026-06-04T00:00:00.000Z",
  "tools": [
    {
      "name": "example_com_page_context",
      "description": "Returns page context.",
      "inputSchema": {
        "type": "object",
        "properties": {},
        "required": []
      },
      "implementation": {
        "kind": "dom",
        "source": "return { success: true, title: document.title, url: location.href };"
      },
      "fixtureInput": {}
    }
  ]
}
```

## Authoring rules

- `implementation.source` is inserted inside `async (input) => { ... }`; write JavaScript statements, not a full function wrapper.
- Return a JSON-serializable object.
- WebMCP code runs inside the browser page. Use browser-native APIs: `document`, `location`, `navigator`, and same-origin `fetch`.
- Do not use Playwright, Puppeteer, Stagehand, XPath helpers, or agent/browser commands inside `implementation.source`.
- `document.querySelector` and `querySelectorAll` must receive valid browser CSS selectors only.
- To find visible text, use `Array.from(document.querySelectorAll(...)).find((el) => (el.textContent || "").includes("..."))`.
- Do not include API keys, bearer tokens, cookies, localStorage secrets, or user credentials.
- Do not use `eval` or `new Function`.
- Avoid destructive actions unless the user explicitly asked for them.
- Make implementations defensive: check for missing elements and return structured `{ success: false, error: "..." }` responses.
- Generated init scripts register WebMCP tools only in the top frame.

## Output layout

```text
artifacts/<domain>/<task>/
  manifest.json
  webmcp.init.js
  stagehand-example.ts
  eval.json
  eval-report.md
```

To turn the example into a standalone project, scaffold a Stagehand app with
`npx create-browser-app` and drop the generated `webmcp.init.js` into it (load it
with `page.addInitScript({ path: "webmcp.init.js" })`).

Attribution

NVlabsNVlabs
View sourceMore from NVlabs →
SSkills DirectorySkills Directory

Know which skills are safe — weekly.

Best new skills + every skill we flagged as malicious. From the team that scanned 103,619.

Join free

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments (0)

No comments yet. Be the first to comment!

SSkills DirectorySkills Directory

Know which skills are safe — weekly.

Best new skills + every skill we flagged as malicious. From the team that scanned 103,619.

Join free

Related Skills

ucoz-landing-skill

Playbook for creating and editing uCoz landing pages via MCP tools (`templates_tool`, `ftp_tool`, `modules_tool`). Use for tasks such as: "build a landing page", "update the homepage as a landing page", "create a promo page on the homepage", "add a lead form / menu / SEO to the homepage". Homepage: `page_list`, `page_get`; first publish — `page_update` with full `page_tmpl`; HTML edits after generation — `patch_template` (module_id=2, template_id=1), not `update_template`. Activate the mail f...

107 votes

Paperclip

Interact with the Paperclip control plane API for task coordination and governance. Use when checking assignments, updating issue status, posting comments, delegating work, managing routines, or calling Paperclip API endpoints.

813271 votes

Instantly Rdsthomas Mission Control

Instantly.ai cold email outreach API - manage campaigns, leads, accounts, and analytics. Use for cold email automation, lead management, campaign creation/monitoring, and email account warmup.

761 votes

Daw Music

Digital Audio Workstation usage, music composition, interactive music systems, and game audio implementation for immersive soundscapes.

761 votes

Caveman Compress

Compress natural language memory files (CLAUDE.md, todos, preferences) into caveman format to save input tokens. Preserves all technical substance, code, URLs, and structure. Compressed version overwrites the original file. Human-readable backup saved as FILE.original.md. Trigger: /caveman-compress FILEPATH or "compress memory file"

1066600 votes
View all in tools →