Use when building, debugging, packaging, or publishing browser userscripts for Tampermonkey or ScriptCat, including GM APIs, metadata blocks, permission…
SaferSkills independently audited develop-userscripts (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Userscript work usually breaks at the runtime and metadata boundary, not in the page logic. Choose the runtime first, declare the minimum permissions up front, then debug in the environment where the script actually runs.
Use this skill for:
GM_* behavior@background or @crontab==UserConfig====UserSubscribe== bundle or preparing a CloudCat-compatible scriptDo not use this skill for full browser extension development or general browser automation outside userscript managers.
digraph userscript_runtime {
"Need page DOM or page context?" [shape=diamond];
"Need persistent or scheduled work?" [shape=diamond];
"Need to install many scripts as one package?" [shape=diamond];
"Portable foreground script" [shape=box];
"ScriptCat background or crontab script" [shape=box];
"ScriptCat subscription package" [shape=box];
"Need page DOM or page context?" -> "Portable foreground script" [label="yes"];
"Need page DOM or page context?" -> "Need persistent or scheduled work?" [label="no"];
"Need persistent or scheduled work?" -> "ScriptCat background or crontab script" [label="yes"];
"Need persistent or scheduled work?" -> "Need to install many scripts as one package?" [label="no"];
"Need to install many scripts as one package?" -> "ScriptCat subscription package" [label="yes"];
"Need to install many scripts as one package?" -> "Portable foreground script" [label="no"];
}Allow User Scripts or browser developer mode before scripts run.@match, @grant, @connect, @run-at, and any update URLs.==UserScript== patterns for ordinary page scripts. Only switch to ScriptCat-only headers when the requested behavior actually needs them.background.html for real-environment debugging.@version accurate and add @updateURL or @downloadURL only when needed.==UserSubscribe==, HTTPS URLs, and subscription-level @connect.| Intent | Default choice | Watch for |
|---|---|---|
| Page UI, DOM scraping, page patching | Portable ==UserScript== | @match, @grant, @run-at, CSP-sensitive injection |
| Cross-origin API access | GM_xmlhttpRequest with explicit @connect | Missing hosts, cookie behavior differences, user authorization |
| Long-running worker | ScriptCat @background | No DOM, must return Promise for async work |
| Scheduled task | ScriptCat @crontab | Only first @crontab counts, prefer 5-field cron, avoid interval overlap |
| User-editable settings | ==UserConfig== plus GM_getValue | Block placement and group.key naming |
| Silent bundle install and updates | ==UserSubscribe== | HTTPS, user.sub.js, subscription connect overrides child scripts |
@grant for APIs the script actually uses.@connect for hosts used by GM_xmlhttpRequest or GM_cookie.@include as a better default than @match for ordinary host targeting.==UserScript== and ==UserSubscribe== packaging concepts.==UserConfig== in the wrong place or reading config keys without the group.key name.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.