Tinyfish Agent Run

Run a TinyFish automation agent against a URL and stream live progress events (STARTED / PROGRESS / COMPLETE) as one-line JSON events. Use when you want to e...

Security Scan

The skill's code and instructions match its stated purpose (streaming TinyFish agent runs) and request only the TinyFish API key, though the packaged script assumes curl and python3 are available but those binaries are not declared.

Purpose & Capability

The skill's name, description, SKILL.md, and script all consistently implement an SSE streamer that POSTs to https://agent.tinyfish.ai/v1/automation/run-sse using X-API-Key: $TINYFISH_API_KEY. The only mismatch is that the script invokes curl and python3 but the skill metadata did not declare any required binaries; these runtime dependencies should be declared so callers know they'll be needed.

Instruction Scope

Runtime instructions and the script only (a) check for TINYFISH_API_KEY, (b) POST a JSON body containing the provided URL and goal to the TinyFish API, and (c) re-emit SSE 'data:' frames as one-line JSON on stdout. The instructions do not read local files, other env vars, or send data to any endpoint other than the documented TinyFish API.

Install Mechanism

There is no install spec (instruction-only skill) and the included script is small and clear. No remote downloads or archive extraction occur. Note: because no install step exists, the script will run directly and thus requires runtime binaries (curl, python3) to be present.

Credentials

Only TINYFISH_API_KEY is required and is appropriate for interacting with the TinyFish API. Users should be aware that this key authorizes runs against the remote TinyFish service and may incur actions/costs; the key should follow least-privilege practices.

Persistence & Privilege

The skill does not request persistent/always-on presence (always:false), does not modify other skill configurations, and does not access system config paths. Agent autonomous invocation remains possible (platform default) but is not combined with additional privileges by this skill.

Assessment

This skill appears to do what it says: it streams TinyFish agent SSE events to stdout and requires only TINYFISH_API_KEY. Before installing, ensure: (1) you trust the TinyFish service and the API key you will supply (keys can trigger runs and possibly incur charges); (2) run-time dependencies curl and python3 are present on your system (the metadata does not declare them); (3) do not provide broader credentials—only the TinyFish API key is needed; (4) if you plan to send sensitive URLs or credentials in the 'goal' or page content, remember this content is transmitted to the TinyFish API for processing; and (5) consider running it in a confined environment or review TinyFish's privacy/docs if you need to limit data exposure.

Execute an autonomous browsing goal against a URL and stream live events. Each SSE event is re-emitted on stdout as a single JSON line so a caller (subagent, TUI, etc.) can display progress as it arrives.

Requires: TINYFISH_API_KEY environment variable.

Pre-flight Check (REQUIRED)

[ -n "$TINYFISH_API_KEY" ] && echo "TINYFISH_API_KEY is set" || echo "TINYFISH_API_KEY is NOT set"

If the key is not set, stop and ask the user to add it. Get one at https://agent.tinyfish.ai/api-keys.

Streaming Run

scripts/agent-run.sh <url> <goal>

Example:

scripts/agent-run.sh https://scrapeme.live/shop "Extract the first 2 product names and prices. Return JSON."

Under the hood this POSTs to https://agent.tinyfish.ai/v1/automation/run-sse with:

{
  "url": "https://scrapeme.live/shop",
  "goal": "Extract the first 2 product names and prices. Return JSON."
}

and the header X-API-Key: $TINYFISH_API_KEY.

Output Format

One JSON object per line on stdout:

{"type":"STARTED","run_id":"abc123"}
{"type":"PROGRESS","run_id":"abc123","purpose":"Navigating to https://scrapeme.live/shop"}
{"type":"PROGRESS","run_id":"abc123","purpose":"Reading product list"}
{"type":"COMPLETE","run_id":"abc123","status":"COMPLETED","result":{...}}

A caller can:

• Render each PROGRESS.purpose as a live status line.
• Detect navigation by matching purpose against Navigating to <url> and surface the URL to an embedded browser view.
• Parse COMPLETE.result for the final payload.

Event Types

• STARTED — {type, run_id} — emitted once when the run begins.
• PROGRESS — {type, run_id, purpose} — one per agent step. purpose is a short human-readable description.
• COMPLETE — {type, run_id, status, result} — emitted once when the run finishes. status is typically COMPLETED.