by Castor6
The first browser AI Agent extension to support Agent Skills, enabling AI to perform complex tasks through an expandable skill system. ๐ Star if you like it! | ้ฆไธชๆฏๆ Agent Skills ็ๆต่งๅจ AI Agent ๆฉๅฑ๏ผ่ฎฉ AI ้่ฟๅฏๆฉๅฑๆ่ฝ็ณป็ปๆง่กๅคๆไปปๅก ๐ ๅฆๆๅๆฌข่ฏท็นไธช Star๏ผ
# Add to your Claude Code skills
git clone https://github.com/Castor6/tactusLast scanned: 5/28/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@hono/node-server: @hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@isaacs/brace-expansion: @isaacs/brace-expansion has Uncontrolled Resource Consumption",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@modelcontextprotocol/sdk: @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@wxt-dev/module-vue: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "ajv: ajv has ReDoS when using `$data` option",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "brace-expansion: brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "defu: defu: Prototype pollution via `__proto__` key in defaults argument",
"severity": "high"
},
{
"type": "npm-audit",
"message": "fast-uri: fast-uri vulnerable to path traversal via percent-encoded dot segments",
"severity": "high"
},
{
"type": "npm-audit",
"message": "hono: Hono added timing comparison hardening in basicAuth and bearerAuth",
"severity": "high"
},
{
"type": "npm-audit",
"message": "minimatch: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
"severity": "high"
},
{
"type": "npm-audit",
"message": "node-forge: Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)",
"severity": "high"
},
{
"type": "npm-audit",
"message": "node-notifier: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "path-to-regexp: path-to-regexp vulnerable to Denial of Service via sequential optional groups",
"severity": "high"
},
{
"type": "npm-audit",
"message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"severity": "high"
},
{
"type": "npm-audit",
"message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "qs: qs's arrayLimit bypass in comma parsing allows denial of service",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "rollup: Rollup 4 has Arbitrary File Write via Path Traversal",
"severity": "high"
},
{
"type": "npm-audit",
"message": "tmp: tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape",
"severity": "high"
},
{
"type": "npm-audit",
"message": "uuid: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "vite: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
"severity": "high"
},
{
"type": "npm-audit",
"message": "web-ext-run: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "wxt: Vulnerability found",
"severity": "high"
}
],
"status": "WARNING",
"scannedAt": "2026-05-28T08:00:25.713Z",
"semgrepRan": false,
"npmAuditRan": true,
"pipAuditRan": true
}tactus is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by Castor6. The first browser AI Agent extension to support Agent Skills, enabling AI to perform complex tasks through an expandable skill system. ๐ Star if you like it! | ้ฆไธชๆฏๆ Agent Skills ็ๆต่งๅจ AI Agent ๆฉๅฑ๏ผ่ฎฉ AI ้่ฟๅฏๆฉๅฑๆ่ฝ็ณป็ปๆง่กๅคๆไปปๅก ๐ ๅฆๆๅๆฌข่ฏท็นไธช Star๏ผ. It has 368 GitHub stars.
tactus returned warnings in SkillsLLM's automated security scan. It has no critical vulnerabilities, but review the flagged issues in the Security Report section before adding it to your workflow.
Clone the repository with "git clone https://github.com/Castor6/tactus" and add it to your Claude Code skills directory (see the Installation section above).
tactus is primarily written in TypeScript. It is open-source under Castor6 on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh tactus against similar tools.
No comments yet. Be the first to share your thoughts!
Requires a passing catalog security scan. Resolve the flagged issues and resubmit to enable featuring.
English | ็ฎไฝไธญๆ
The First Browser AI Agent Extension with Agent Skills Support
[![Chrome Version][chrome-version-shield]][chrome-store-link] [![Chrome Users][chrome-users-shield]][chrome-store-link] [![Firefox Version][firefox-version-shield]][firefox-store-link] [![Firefox Users][firefox-users-shield]][firefox-store-link]
Tactus is an innovative browser extension that brings the Agent Skills specification to the browser environment, enabling AI Agent to perform complex tasks through an extensible skill system.
Triggering skills can achieve prompt injection for specific scenarios, and common workflows can be encapsulated in scripts for execution, replacing repetitive automated operations of AI Agents. This approach is both fast and token-efficient.

Tactus is the first product to implement the Agent Skills specification in a browser extension:



Connect to external tool servers via Model Context Protocol, extending AI capabilities:
https://github.com/user-attachments/assets/c7737e7e-dd2e-4888-a030-db40b9731f1d
/v1/chat/completions path to simplify API configuration| Browser | Download |
|---|---|
| Chrome | [Chrome Web Store][chrome-store-link] |
| Firefox | [Firefox Add-ons][firefox-store-link] |
Or download from GitHub Releases for manual installation.
tactus.zip to a permanent directorychrome://extensions/ in ChromeDeveloper mode (top right)Load unpacked (top left)tactus foldernpm run build:firefoxabout:debugging#/runtime/this-firefoxLoad Temporary Add-on.output/firefox-mv2/manifest.jsongit clone https://github.com/Castor6/tactus.git
cd tactus
npm install
npm run dev
npm run dev:firefox
npm run build
npm run build:firefox
.claude\skills\design-style skills to design with a unified extended UI style.
SKILL.mdmy-skill/
โโโ SKILL.md # Required: Skill definition and instructions
โโโ scripts/ # Optional: Executable scripts
โ โโโ fetch-data.js
โโโ references/ # Optional: Reference documents
โ โโโ api-docs.md
โโโ assets/ # Optional: Resource files
โโโ template.json
---
name: my-skill
description: This is an example skill
---
# Skill Instructions
When user needs to perform a task, follow these steps:
1. First analyze user requirements
2. Call scripts/fetch-data.js to fetch data
3. Organize and return results
Tactus provides the following built-in tools for AI:
| Tool | Description |
|---|---|
extract_page_content |
Extract main content from current page |
activate_skill |
Activate a specified Skill |
execute_skill_script |
Execute script within a Skill |
read_skill_file |
Read file content from a Skill |
| MCP Tools | Dynamically fetched tools from connected MCP Servers |
tactus/
โโโ entrypoints/
โ โโโ background.ts # Background script
โ โโโ content.ts # Content script
โ โโโ sidepanel/ # Sidebar UI
โ โโโ options/ # Settings page
โโโ components/ # Vue components
โโโ utils/
โ โโโ anthropic.ts # Anthropic (Claude) API integration
โ โโโ api.ts # API calls & tool execution
โ โโโ db.ts # IndexedDB operations
โ โโโ gemini.ts # Gemini (Google) API integration
โ โโโ storage.ts # Settings & storage management
โ โโโ i18n.ts # Internationalization
โ โโโ mcp.ts # MCP Client management
โ โโโ mcpOAuth.ts # MCP OAuth 2.1 auth
โ โโโ mcpStorage.ts # MCP config storage
โ โโโ skills.ts # Skills core logic
โ โโโ skillsExecutor.ts # Script executor
โ โโโ skillsImporter.ts # Skills import
โ โโโ tools.ts # Tool definitions
โ โโโ pageExtractor.ts # Page content extraction
โโโ public/ # Static assets