--- name: backlink description: OpenCLI-first backlink discovery, profile analysis, opportunity qualification, safe browser-assisted form filling, evidence-based verification, and bulk data harvesting from logged-in dashboards. Use for backlinks, external links, competitor link research, blog-comment opportunities, directory submissions, Similarweb/Semrush/Ahrefs discovery, Search Console verification, anchor analysis, toxic-link review, disavow review, outreach templates, scraping SaaS report tables that have no API, driving the owner's logged-in Chrome from a script, or Chinese requests such as 反链、外链、找外链、发外链、评论外链、外链分析、抓后台数据、导出报表、数据面板、数据勘测. ---

<skill name="backlink" version="3.0" body-format="xml">

<why-xml> The frontmatter above stays YAML because the Skill loader reads it for discovery. Everything below is XML because this Skill is mostly laws and routing, and a law that is easy to skim past is a law that gets broken. Tagged blocks make "which rule did I just violate" answerable by name. </why-xml>

<mission> One business Skill for the complete backlink lifecycle. Do not split it back apart, and do not create another browser-extension Skill — OpenCLI and its Chrome extension are the connector underneath this Skill, never a separate business workflow.

Two former Skills were merged in on 2026-08-16 and deleted: `backlink-analyzer` (analysis templates, toxicity rubric, outreach — now in three references under its original Apache-2.0 licence) and `browser-harvest` (pulling tables out of logged-in dashboards — now <ref file="references/harvest.md"/>). The harvest knowledge is general-purpose: ad platforms, e-commerce backends, any no-API SaaS report. When a harvesting task has nothing to do with links, load this Skill anyway and read that one reference. </mission>

<map> <summary> Two things live here and they answer different questions. **The data files are the asset; the references are how to use them and how not to fool yourself.** </summary> <tree><![CDATA[ backlink/ ├── SKILL.md ← you are here: laws + routing + workflow entry points ├── CONTRIBUTING.md ← how to submit a PR, the data model, the evidence rule │ ├── data/ ← THE DATABASE. Machine-readable, PR-able, CI-checked. │ ├── free-channels.json places that publish a link at no cost │ ├── submission-targets.json routes that ACCEPT a submission — first-pass library │ ├── paid-platforms.json platforms observed carrying purchased placements │ ├── index-submission.json engines that take a URL and publish NO link │ └── schema/ JSON Schema for the files above │ ├── scripts/ ← run these; do not re-derive their knowledge by hand │ ├── validate-data.mjs PR gate. CI runs exactly this. Must exit 0. │ ├── health.mjs run before ANY browser task │ ├── opencli-core.mjs ★ defaultSession(), run(), closeSession() │ ├── lib-tools-share.mjs ★ the ONE panel launcher │ ├── tools-share-open.mjs launch a tool by name; --goto for a deep link │ ├── similarweb-query.mjs performance | channels | similar-sites │ ├── similarweb-batch.mjs bulk traffic screen — one login, N domains, resumable │ ├── semrush-batch.mjs same, on the other card's quota (organic traffic) │ ├── semrush-overview.mjs AS / organic traffic / ref-domains / keywords │ ├── semrush-keyword.mjs one keyword: volume, KD, CPC, per-country split │ ├── semrush-report.mjs the OTHER four no-export reports; reuses one session │ │ table reports paginate — pass --all-pages or it warns │ ├── page-read.mjs render a public page → text, prices, paywall shape │ ├── apply-traffic-screen.mjs write verdicts back into submission-targets.json │ ├── inspect-page.mjs dump one target's form / login / CAPTCHA state │ ├── safe-fill.mjs fill a reviewed payload, never submit │ ├── release-submit-guard.mjs only after explicit per-submission approval │ ├── submit-directory.mjs the single-target driver; one session per staged site │ ├── adapter-phpld.mjs ★ reference implementation of one-session-per-site │ ├── ledger.mjs candidate → … → indexed → rel_verified │ ├── discovery-queue.mjs recursive competitor/commenter expansion │ ├── harvest-commenters.mjs pull commenter domains off an article │ ├── third-party-list-ingest.mjs someone else's list → screened leads + diff │ ├── probe-submission-targets.mjs leads → reachability, route, gate, price │ ├── merge-submission-targets.mjs fold a probe run into the two data files │ ├── targets-select.mjs pick ONE batch: --cohort open | captcha | … │ ├── paid-platform-registry.mjs merge a harvest into the paid registry │ └── harvest-*.{sh,mjs,js} bulk table extraction from logged-in dashboards │ └── references/ ← method, traps, and why the rules are the rules ├── browser-runtime.md ★★ READ FIRST for any browser work. The laws + measurements. ├── traffic-screen.md ★ the qualifying gate, and why it runs before the form ├── submission-lanes.md ★ lanes, cohorts, the three guards, staged queues ├── instant-publish.md ★ free channels: how each class behaves, what kills them ├── paid-platforms.md ★ paid: tiers, why a burst is not a purchase ├── batch-campaign.md ★ 100+ rows: queue, idempotency, resume, reporting ├── index-submission.md index-only channels; why `indexed` must name an engine ├── authorized-data-sources.md the panel, the cards, quota, expiry, the traps ├── field-notes.md what actually blocks submissions in practice ├── harvest.md scraping failures that look like success ├── safety-policy.md read before any fill / submit / logged-in action ├── acquisition-doctrine.md the standing ruling on what is worth pursuing ├── discovery-loop.md · link-quality-rubric.md · analysis-templates.md ├── outreach-templates.md · backlinkdirs.md · prompts.md · credits.md └── LICENSE-analysis-templates-Apache-2.0 ]]></tree> <path-rule>Resolve every path in this file relative to this SKILL.md.</path-rule> </map>

<routing> <summary>Match the ask to a starting point. When two rows fit, take the lower one — it is more specific.</summary> <route ask="Somewhere I can post without registering"> `data/free-channels.json` filtered to `account: "none"` and `status: "live"`, then <ref file="references/instant-publish.md"/> for that class's mechanics. Directory submission does NOT satisfy this ask; burning a campaign discovering that is the common failure. </route> <route ask="What paid options exist / where did this competitor buy its links"> <ref file="references/paid-platforms.md"/>, then `data/paid-platforms.json` sorted by how many independent sites were observed using each. </route> <route ask="Find me new opportunities"> <ref file="references/discovery-loop.md"/> — merge whatever you harvest back into the registry. </route> <route ask="Where can I submit this site"> `node scripts/targets-select.mjs --stats`, then one cohort at a time per <ref file="references/submission-lanes.md"/>. </route> <route ask="Is this link profile any good"> <ref file="references/link-quality-rubric.md"/> </route> <route ask="Get these numbers out of a dashboard with no API"> <ref file="references/harvest.md"/> </route> <route ask="Here are 300 directories, submit to them / a campaign that must survive interruption"> <ref file="references/batch-campaign.md"/>. The single-target loop is correct per target and wrong per campaign. </route> <route ask="Someone published a list of backlink sites, is it useful"> `scripts/third-party-list-ingest.mjs` to normalise and diff it, then the "Reading a third-party list" section of <ref file="references/instant-publish.md"/>. </route> <route ask="Submit our pages to Brave / another engine, why is our index count low"> <ref file="references/index-submission.md"/>. It publishes no link, so it never enters the placement ledger. </route> <route ask="Should we post here at all — off-topic host, low DR, known nofollow"> <ref file="references/acquisition-doctrine.md"/> BEFORE rejecting anything. </route> <route ask="Just open this page and tell me what is on it"> <workflow-ref id="explore"/> — still OpenCLI, still a script. </route> <query-the-data> Query the data rather than reading JSON by eye. <cmd><![CDATA[ node -e 'const d=require("./data/free-channels.json");console.log(d.channels.filter(c=>c.account==="none"&&c.status==="live").map(c=>`${c.id}\t${c.kind}`).join("\n"))' node scripts/paid-platform-registry.mjs list --min-sites 2 ]]></cmd> </query-the-data> </routing>

<browser-runtime> <summary> `$backlink → scripts and policy → OpenCLI → the owner's authorized Chrome → website`

Every script here shells out to the `opencli` binary, which drives the owner's own logged-in Chrome through the OpenCLI extension. No Playwright, no headless instance, no remote runtime. That identity is the entire reason this Skill exists, and it is why the laws below matter.

**Read <ref file="references/browser-runtime.md"/> before any browser work.** It carries the measurements behind every law here, the two other drivers and what they cost, and an ordered checklist for diagnosing "something stole my tab". </summary>

<default-driver> OpenCLI is the default for **everything**, including a quick ad-hoc look at one page. It reaches the owner's Chrome through an extension plus a local daemon, and because it is a CLI, any agent runtime that can run a shell command gets the identical capability — Claude Code, Codex, anything else. Work done through a runtime-specific tool cannot be replayed from a script or from another agent later, which defeats the reason this Skill has scripts.

Use an existing OpenCLI adapter first. When no adapter exists, use a named browser session with DOM/network inspection. </default-driver>

<law id="one-session-one-tab" weight="load-bearing"> <statement> `opencli browser &lt;session&gt;` is a one-page abstraction. **A session name owns exactly one tab.** Different names never steal from, switch, or pollute each other. So N pages need N session names. </statement> <why> This inverts the intuition most people arrive with, which is why it is stated first. Measured 2026-08-21 under three concurrent agents: distinct session names produced **zero** cross-agent thefts across 4 rounds × 3 pages; three agents sharing the name `work` produced 3, 12, and 2 thefts, one of them missing on every check it made. Re-confirmed the same day against this Skill as written: three agents told only to follow it scored **36/36 clean with zero leaked tabs**. </why> <correct><![CDATA[ opencli browser recon-sw-notion --window background open "https://..." opencli browser recon-sw-figma --window background open "https://..." opencli browser recon-sem-rival --window background open "https://..." ]]></correct> </law>

<law id="no-multi-tab-api" weight="load-bearing"> <statement> Do not use `tab new`, `tab select`, or `open --tab` to hold several pages under one session. All three fail, and every one fails **silently** — the command reports success and the next read returns the wrong page. </statement> <why> Measured 2026-08-21 on opencli 1.8.6: a session tracks only its newest tab, so earlier ids drop out of `tab list`; `tab select` returns success with no effect on reads; `open --tab &lt;id&gt;` opens a **new** tab and leaves the named one untouched; and `get` does not accept `--tab` at all, so a run using `get url` to confirm its position cannot be right about it. One three-agent run took the owner's Chrome from 11 tabs to 30 orphans. </why> <instead> `--tab` works on `open`, `state`, `extract`, `find`, and `click`. When a read must name its target, use