Auto-discover and use Web Skills Protocol (WSP) skills when interacting with websites. Use this skill whenever the user asks you to interact with, use, or pe...
When a user asks you to interact with a website, check for published skills first before attempting to scrape HTML, guess at UI elements, or reverse-engineer APIs.
Fetch {origin}/skills.txt (e.g., https://bobs-store.com/skills.txt).
Fetch {origin}/agents.txt.
The discovery file is Markdown with this structure:
# Site Name
> Brief description of the site.
General notes (auth info, rate limits, etc.)
## Skills
- [Skill Name](/skills/skill-name/SKILL.md): What the skill does
## Optional
- [Extra Skill](/skills/extra/SKILL.md): Less important skills
Extract:
- [Name](url): description line is one skillCompare the user's request against each skill's description. Pick the best match.
Fetch the matched skill's URL (e.g., /skills/search/SKILL.md).
The SKILL.md has two parts:
YAML frontmatter (between --- delimiters):
name — skill identifierdescription — detailed trigger and capability infoversion — skill versionauth — authentication method: none, api-key, bearer, oauth2base_url — base URL for API calls (if different from site origin)rate_limit — rate limit information (object with two optional sub-fields):
agent — the publisher's recommended rate limit for AI agents (e.g., 20/minute). This is the limit you SHOULD respect.api — the actual API endpoint rate limit (e.g., 100/minute). You MUST NOT exceed this.Markdown body — the actual instructions. Follow them directly. They contain:
Follow the SKILL.md instructions to complete the user's request. Use the specified base_url, auth method, and endpoints exactly as documented.
Always check skills.txt first. Before any HTML scraping or UI automation on a website, check for WSP support. One HTTP request saves minutes of guessing.
Respect robots.txt. If robots.txt disallows /skills/ or /agents/, do NOT fetch skill files from those paths.
Cache within session. Fetch skills.txt/agents.txt once per site per session. Don't re-fetch on every interaction with the same site.
Don't over-fetch. Only fetch the SKILL.md files you actually need. Don't download every skill "just in case."
Auth requires user consent. If a skill requires authentication (auth is not none), tell the user what credentials are needed and where to get them. Never fabricate or guess credentials.
Prefer skills over scraping. When a site publishes WSP skills, use them instead of parsing HTML. Skills give you structured API access — faster, more reliable, and what the site owner intended.
Stay in scope. A skill describes specific operations. Don't extrapolate beyond what the skill documents. If the user wants something the skill doesn't cover, say so.
Respect rate limits. If the skill specifies a rate_limit, respect both sub-fields:
rate_limit.agent — the publisher's recommended limit for AI agents. SHOULD NOT exceed this.rate_limit.api — the hard API limit. MUST NOT exceed this. If only one sub-field is present, treat it as the effective limit.Discovery order: /skills.txt → /agents.txt → no WSP support
Skill directory: /skills/{name}/SKILL.md or /agents/{name}/SKILL.md
Skill format: YAML frontmatter + Markdown instructions
Auth methods: none | api-key | bearer | oauth2
Cache policy: Once per site per session
User says: "Search for wireless headphones under $100 on bobs-store.com"
https://bobs-store.com/skills.txt → 200 OK/skills/search/SKILL.mdauth: none, base_url: https://api.bobs-store.com/v1GET /products?q=wireless+headphones&max_price=100ZIP package — ready to use