A skill is trusted instruction text — optionally with its own tool manifest — that WebBrain loads into a run only when it is relevant. Manage them under Settings → Skills. It lists your enabled skills first, where you can edit or remove any of them, bundled ones included, and then the packaged skills you can enable. Add skill opens the form for importing a skill from a URL or pasting its text; Edit opens the same form with that skill loaded.
Mid and Full runs receive a small catalog of eligible skills: ID, name, summary,
and optional canonical semantic intents. Full instructions are appended to the
system prompt only after the skill is activated for the current run, via
load_skill. Compact tier disables skills entirely — no loader, no skill
prompt, no skill tools.
Imported skills are copied into browser local storage.
An optional fenced webbrain-skill JSON block can declare:
| Field | Meaning |
|---|---|
summary |
Maximum 200 characters |
modes |
ask, act, and/or dev |
intents |
Up to six canonical intents such as verification_code or public_media_download |
Intents are cross-language meaning hints for the LLM, not literal keyword matching. Skills without metadata infer the first prose paragraph as their summary, have no inferred intents, and default to Act/Dev.
WebBrain also recognizes the required name and description YAML frontmatter
from an imported Agent Skills SKILL.md.
The name and description populate the routing catalog, and the frontmatter is
removed before the Markdown body is loaded. A name entered in Settings and a
webbrain-skill block still take precedence.
This is instruction-only compatibility. WebBrain imports one text document; it
does not fetch bundled scripts/, references/, or assets/, execute skill
code, or treat the Agent Skills allowed-tools field as a WebBrain permission
or tool manifest. Use webbrain-tools for WebBrain HTTP tools. WebBrain
recognizes webbrain-skill and webbrain-tools fences only in the Markdown
body after valid frontmatter; fence-like text inside frontmatter cannot grant
routing eligibility or register tools.
A skill can expose read-only HTTP tools, or short-lived download-job tools, with
a fenced webbrain-tools JSON manifest.
Importing a skill is the trust boundary for its declared HTTPS endpoint.
Download-job skill tools still run in Act mode and use the normal Downloads
permission gate before saving files. Tool results derived from third-party
content should be marked resultPolicy: "untrusted" so they are wrapped as
data, not instructions.
Skill HTTP tools reject redirects (including opaque browser redirects), so manifests must use a final HTTPS host that does not 3xx.
Skill tools are not part of the static tool matrix: before a skill is loaded, or after it is removed, its tools are absent.
Packaged skill markdown lives under skills/ and is registered in
PACKAGED_SKILL_SOURCES (agent/skills.js). Settings → Skills lists every
packaged skill; only the defaults below are seeded enabled.
All defaults can be removed from Settings → Skills. A removed default is not silently restored, including by preactivation.
Can expose read_youtube_transcript, fetch_nytimes_article,
resolve_public_media, and download_public_media through its skill manifest.
On NYTimes / The Athletic tabs it is preactivated for the current run so a
structured blocking pageGate can route directly to the credentialless article
fallback.
Public video downloads include Bluesky and Mastodon. Bluesky post permalinks are sent to FreeSkillz for server-side HLS assembly into one MP4 with audio. Mastodon status permalinks work across public instances. On feeds/profiles, first identify the visible target and obtain its exact post/status link.
Loads only for relevant requests and declares no external network tool. On Mid
and Full it adds one narrow internal reader for an already open, signed-in
supported webmail tab. A provider-verified already-open message is read directly.
Candidate discovery otherwise leaves the mailbox untouched; candidate disclosure
requires the full normalized service identity or all sufficiently discriminative
service tokens. inspect remains read-only in Ask. Because opening can mark an
email read, open_message requires Act/Dev and normal click permission for the
mailbox host; the selected inbox item opens only in a temporary inactive duplicate
that is closed after every bounded message-scoped continuation is consumed.
Incomplete, changed, or unscoped continuations fail closed. The model receives opaque message
references, not a tab catalog, mailbox URLs, or accessibility references. Compact
keeps no skill or cross-tab tool surface. On the active run tab the skill still
prefers selected text or a bounded accessibility-tree subtree, excludes
SMS/native-app access, and honors Strict secret handling.
When used, the scoped page content and the code are included in the normal request to your configured LLM provider. If Record traces is enabled, raw tool results and model responses are also stored locally until those traces are deleted.
Rewrites prose WebBrain composes for you, such as an email reply or a post, so it reads as human writing. It declares no network tool and adds no tools.
On webmail tabs (Gmail, Outlook, Yahoo, Proton, Fastmail, Zoho, Yandex) it is
preactivated for the current run, so a reply is humanized without spending a
load_skill hop. Preactivation rides on the site-adapter match, so it does
nothing when Site adapters is turned off in Settings; the skill then loads
through the catalog like anywhere else. Elsewhere it loads through the normal
catalog when the request is about drafting or rewriting text. It returns only
the final text; it does not report what it changed unless you ask.
Select text anywhere and you get a Humanize entry, both in the popup and in the right-click menu. That explicit entry preactivates the skill on any site; later turns in the same selected-text conversation keep it. The canned readers — Summarize, Explain, Quiz me, Proofread, Translate — and free-form questions typed into the selection box do not, since they do not establish a structured writing request. This routing exists because a selected-text run carries no tools at all: the catalog is out of reach, so a skill that is not loaded when the run starts cannot be loaded later.
It rewrites only prose being composed for a human reader. Quoted material, addresses, codes, prices, form-field values, and wording you supplied verbatim are left alone.
Loads through the catalog for relevant Act/Dev content tasks on Mid and Full; it is not preactivated for every WordPress page. It adds no tool or authentication bridge. Compact keeps skills disabled and receives short WordPress adapter guidance through the existing site-adapter path.
For posts, pages, REST-enabled custom types, and their taxonomy, the recipe
prefers the API when all requested fields and the signed-in session are supported
and API mutations are authorized. If the API is viable but permission is missing,
it asks once for /allow-api; existing grants are reused. Ask mode cannot write.
It reuses existing record IDs, creates new content as a draft, verifies content
and term IDs, then publishes that same record only when requested. Uncertain
writes must be reconciled before retrying or creating through the editor.
The recipe uses ordinary fetch_url with session cookies and a REST nonce in
X-WP-Nonce. That nonce can enter the configured LLM conversation and recorded
traces. Strict secret handling uses the UI instead, without requesting that
the setting be disabled. Unsupported fields, missing sessions, denied access,
or a declined API grant lead to existing Code/Text/Classic editor surfaces before
considering a plugin. Installing plugins or changing site-wide editor settings
still requires explicit authorization. See the
packaged recipe and
WordPress authentication documentation.
Nine separate instruction-only skills cover Ghost, Drupal, Joomla, Webflow, Shopify, Wix, Strapi, Contentful and Sanity. Each appears in the default catalog in Ask/Act/Dev on Mid/Full; only the recipe selected for the current content task is loaded. They add no HTTP tool manifest, credential store or OAuth integration. See CMS API-first boundaries and validation for the service matrix and test coverage.
For these CMS content tasks, WebBrain prefers the official API after read-only
capability/auth discovery when the target, required fields, task scope, service
rights and WebBrain mutation permission all permit it. Editor failure is not a
prerequisite. An otherwise usable API with permission off prompts once for
/allow-api; existing permission is reused and refusal is respected. Ask stays
read-only. GraphQL/query POSTs remain subject to the same method-based gate.
Compact still has no skill loader or skill prompt. Short CMS adapter notes guide its existing tools on supported CMS routes. Generic admin/Studio paths add no CMS adapter notes; custom editors require observed CMS evidence. The shared prompt contains only the conditional CMS rule, not nine endpoint recipes. A URL match is not evidence of API authentication or authorization; confirm the observed editor/API identity before applying a recipe.
Startup uses the existing default-removal tombstones: newly introduced defaults are added when there is capacity, while a removed/disabled default stays removed across startup and bundled-content refresh. Disabling a skill currently means removing it from the enabled Settings list. No user skill is evicted when the 20-skill limit is full; the new packages remain available to enable explicitly.
These ship in the extension and appear under Settings → Skills as available to enable. They are not seeded on by default.
| Skill | Modes | Network tools |
|---|---|---|
| Disposable email (Mail.tm) | Act, Dev | Mail.tm HTTPS API |
| Temporary file share (Litterbox) | Act, Dev | Uses browser upload tools; short-lived public link |
| Open-Meteo weather | Ask, Act, Dev | Geocoding + forecast HTTPS |
| Open Library | Ask, Act, Dev | Open Library search HTTPS |
| Wikipedia | Ask, Act, Dev | Live Wikipedia APIs + explicitly installed Kiwix/ZIM archives |
| Turkish deasciifier | Ask, Act, Dev | Instruction-only; uses ordinary verbatim form-entry tools |
| Phone calls (Phonr) | Ask (instructed GET only), Act, Dev | Bearer-authenticated fetch_url to https://phonr.xyz/v1; POST requires the existing API-mutation permission |
Enable a skill only when you want its tools and instructions available for
load_skill on eligible runs.
The optional Apocalypse Mode management page lets users
choose a Wikipedia language and Kiwix archive tier, review exact size and
license metadata, install resumably, import an existing .zim, and manage its
lifecycle. It is independent from the interface language, disabled by default,
and never downloads an archive merely because the Wikipedia skill is enabled.
Installed archive passages retain canonical attribution and remain untrusted.
Enable Phone calls (Phonr) under Settings → Skills, then ask WebBrain to call
a person or business with a specific purpose and language. Supply your Phonr
bearer key for that service; the packaged skill contains no credential and cannot
read the server's .env. Act/Dev calls use fetch_url with the existing
/allow-api or persistent API-mutation authorization. Ask mode can read call
status and results through the skill's instructions; fetch_url does not enforce
that restriction. Previewing uses POST but never places a call. The service
address is https://phonr.xyz/v1; installing the skill does not deploy it.
The skill preserves an idempotency key across interrupted starts, follows the same call through completion, handles uncertain provider status without redialing, and distinguishes a call ending from its purpose being fulfilled. Caller number, recording mode, and duration limit come from the Phonr server. It uses the default natural-conversation system message unless the user requests a change. Example: “Call this restaurant in Spanish and ask whether a table for four is available tonight at 7. Get the options; don't book yet.”
This is an instruction-only API integration: its bearer header is part of
model-generated fetch_url arguments, so the key may appear in the configured
LLM conversation and enabled traces. Do not embed it in skill text, memory,
scheduled instructions, or links. The skill can inspect transcript, result, and
clip metadata; WebBrain's generic download tool cannot attach a bearer header,
so actual audio retrieval uses the local Phonr dashboard or the authenticated
curl example in the skill. It does not claim to play audio from metadata alone.
Keep service details in separate skills so the always-present prompt only needs the routing and permission rules. WordPress's recipe covers content operations; Mail.tm documents disposable-mail signup and its API fallback; Phonr documents phone-call authorization, status, and interrupted-start reconciliation. These services have different authentication, capabilities, and retry behavior, so a generic instruction to use any available API is insufficient.
A new recipe should describe discovery, supported operations/fields, permission requirements, credential exposure, verification, ambiguous-write recovery, and the UI fallback. Prefer existing tools; loading a skill never grants API mutation permission or broadens the user's requested outcome. Service-specific API-first exceptions must also agree with the shared prompts. Existing Mail.tm and Phonr workflows retain their own rules; the WordPress exception does not change them.
- Opt-in external memory proposal — why hosted MemCode needs an extension-owned OAuth flow before it can be packaged as a skill
- Agent tools — tiers, modes, and the full tool matrix
- Privacy and data flow
- Architecture — skills and dynamic tool exposure in the turn flow