← Back to Skills Marketplace
Surfagent Browser
by
AgentOSsoftware
· GitHub ↗
· v1.0.0
· MIT-0
91
Downloads
0
Stars
1
Active Installs
1
Versions
Install in OpenClaw
/install surfagent-browser
Description
Control a real Chrome browser from your AI agent — navigate, click, type, fill forms, extract content, manage tabs, and automate workflows via SurfAgent's RE...
Usage Guidance
This skill lets an agent control a real Chrome browser on your machine, access logged-in sessions, run arbitrary page JS, fill forms (including credentials), and attempt CAPTCHA solves. Before installing: 1) Verify the SurfAgent daemon's provenance (download source, checksums, signing) and run it only if you trust it. 2) Find out how the Bearer token is issued/stored — do not provide agent or global secrets unless you intend to grant full browser control. 3) Prefer running SurfAgent with a dedicated, isolated Chrome profile (no saved passwords or personal sessions) or in a VM/container to limit exposure. 4) Ask the author why 'node' is required in metadata; it's not justified by the HTTP-only instructions. 5) Treat /browser/evaluate and content-extraction endpoints as high-risk: they can read and exfiltrate sensitive data, so only enable this skill for agents you trust and consider network/firewall rules that prevent unexpected outbound exfiltration. If you cannot confirm the daemon's trustworthiness or the token-management details, do not enable this skill.
Capability Analysis
Type: OpenClaw Skill
Name: surfagent-browser
Version: 1.0.0
The surfagent-browser skill provides an extensive API for controlling a local Chrome instance, including high-risk functions like arbitrary JavaScript execution (/browser/evaluate), file system interaction (/browser/upload, /browser/download), and CAPTCHA solving. While these capabilities are consistent with the tool's stated goal of browser automation, they provide a broad primitive for potential abuse or unintended actions by an AI agent. The documentation in SKILL.md also instructs the agent to access a local credential file (~/.surfagent/daemon-token.txt) to authenticate with the local daemon.
Capability Assessment
Purpose & Capability
The skill's stated purpose (control a real Chrome via SurfAgent REST API on localhost:7201) matches the API calls documented in SKILL.md. However the registry metadata lists node as a required binary even though the runtime examples use curl/HTTP; it's unclear why node is required. This mismatch is unexplained and unnecessary for an instruction-only HTTP client.
Instruction Scope
The instructions direct the agent to call a localhost REST API that controls a real Chrome with persistent cookies and sessions. The API includes endpoints for evaluating arbitrary JavaScript (/browser/evaluate), extracting page state and content, filling forms (including credentials), and solving CAPTCHAs. Those actions legitimately belong to a browser-control skill, but they also provide broad access to sensitive user data and the ability to act as the user. SKILL.md does not specify where or how the Bearer token is managed, nor does it constrain use of evaluate() which can be used to read any page data and exfiltrate it to the agent.
Install Mechanism
Instruction-only skill with no install spec and no code files — the lowest-risk install mechanism. Nothing is written to disk by the skill itself.
Credentials
The skill declares no required environment variables, yet it relies on a Bearer auth token for localhost:7201 calls — SKILL.md does not declare how the agent obtains that token or whether it should be provided via env. The declared requirement of the node binary is disproportionate given the HTTP-based instructions. The combination of missing token guidance and an unexplained binary requirement is inconsistent.
Persistence & Privilege
The skill is not set to always:true and uses normal autonomous invocation settings. That is appropriate. However the capability it triggers—control of the user's real Chrome with persistent cookies/sessions—gives the skill a high effective privilege (ability to access logged-in accounts and perform actions). This is a design-level risk (powerful capability) rather than a metadata misconfiguration.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install surfagent-browser - After installation, invoke the skill by name or use
/surfagent-browser - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release of SurfAgent Browser skill: control a real Chrome via REST API.
- Enables navigation, clicking, typing, form filling, content extraction, screenshots, and tab management on a real Chrome browser from your agent.
- Provides robust API endpoints for automation, including navigation, interaction, state inspection, and file operations.
- Supports real browser sessions—persistent cookies and sessions emulate human browsing and bypass bot detection (unlike headless).
- Includes advanced features: CAPTCHA detection/solving, auto-blocker resolution, multi-field form filling, uploads/downloads, and browser lifecycle management.
- Comprehensive API documentation and usage patterns included for common automation scenarios.
Metadata
Frequently Asked Questions
What is Surfagent Browser?
Control a real Chrome browser from your AI agent — navigate, click, type, fill forms, extract content, manage tabs, and automate workflows via SurfAgent's RE... It is an AI Agent Skill for Claude Code / OpenClaw, with 91 downloads so far.
How do I install Surfagent Browser?
Run "/install surfagent-browser" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Surfagent Browser free?
Yes, Surfagent Browser is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Surfagent Browser support?
Surfagent Browser is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Surfagent Browser?
It is built and maintained by AgentOSsoftware (@agentossoftware); the current version is v1.0.0.
More Skills