功能描述

Automate web browser interactions using natural language via CLI commands. Use when the user asks to browse websites, navigate web pages, extract data from websites, take screenshots, fill forms, click buttons, or interact with web applications.

使用说明 (SKILL.md)

Browser Automation

Name: Browser Automation CLI
Author: peytoncasper

Automate browser interactions using Stagehand CLI with Claude.

First: Environment Selection (Local vs Remote)

The skill automatically selects between local and remote browser environments:

If Browserbase API keys exist (BROWSERBASE_API_KEY and BROWSERBASE_PROJECT_ID in .env file): Uses remote Browserbase environment
If no Browserbase API keys: Falls back to local Chrome browser
No user prompting: The selection happens automatically based on available configuration

Setup (First Time Only)

Check setup.json in this directory. If setupComplete: false:

npm install    # Install dependencies
npm link       # Create global 'browser' command

Commands

All commands work identically in both modes:

browser navigate \x3Curl>                    # Go to URL
browser act "\x3Caction>"                    # Natural language action
browser extract "\x3Cinstruction>" ['{}']    # Extract data (optional schema)
browser observe "\x3Cquery>"                 # Discover elements
browser screenshot                        # Take screenshot
browser close                             # Close browser

Quick Example

browser navigate https://example.com
browser act "click the Sign In button"
browser extract "get the page title"
browser close

Mode Comparison

Feature	Local	Browserbase
Speed	Faster	Slightly slower
Setup	Chrome required	API key required
Stealth mode	No	Yes
Proxy/CAPTCHA	No	Yes
Best for	Development	Production/scraping

Best Practices

Always navigate first before interacting
View screenshots after each command to verify
Be specific in action descriptions
Close browser when done

Troubleshooting

Chrome not found: Install Chrome or use Browserbase mode
Action fails: Use browser observe to discover available elements
Browserbase fails: Verify API key and project ID are set

For detailed examples, see EXAMPLES.md. For API reference, see REFERENCE.md.

安全使用建议

Do not run the suggested setup steps blindly. Key warnings: - Manifest vs docs mismatch: the registry says no env vars required but the docs expect ANTHROPIC_API_KEY and optional Browserbase keys. Treat those as sensitive secrets. - The SKILL.md instructs reading a local .env automatically without prompting — that could expose API keys or other secrets. Ensure the agent is not allowed to read .env or other config files unless you explicitly permit it. - The instructions recommend `npm install` and `npm link`, which will fetch and install Node packages and create a global command. Inspect any package.json and the source code first (and prefer not to run npm link globally) because this changes your system and can run arbitrary code. - The tool preserves a Chrome profile directory and download folder; that can retain cookies, sessions, and downloaded files. If you install, isolate it (use a VM/container) and do not reuse your regular browser profile. - Before installing, request the actual package source (package.json, package lock, and the CLI source). If you cannot review the code or provenance, avoid installing. Also prefer explicit prompts/consent for using remote Browserbase or model API keys rather than automatic selection.

功能分析

Type: OpenClaw Skill Name: Developer: Version: Description: OpenClaw Agent Skill The skill is classified as suspicious due to its inherent high-risk capabilities, despite being transparently documented and aligned with its stated purpose of browser automation. Key indicators include full browser access with network capabilities (including potential access to internal networks), unrestricted file download functionality to `./agent/downloads/`, and the persistence of credentials (saved passwords, cookies) within the `.chrome-profile/` directory, as detailed in `REFERENCE.md`. Additionally, the skill's setup involves executing `npm install` and `npm link` via Bash, as instructed in `SKILL.md` and `setup.json`, which are powerful commands. While these capabilities are necessary for a browser automation tool, they present significant security risks if misused or if the agent is compromised.

能力评估

⚠ Purpose & Capability

Name/description claim simple browser automation. However the included docs reference requiring an ANTHROPIC_API_KEY and optional Browserbase keys (BROWSERBASE_API_KEY, BROWSERBASE_PROJECT_ID) and an npm-installed CLI. The registry metadata declares no required env vars or binaries — that mismatch is unexplained. A legitimate CLI-based browser skill would reasonably need an API key for the model or Browserbase creds and a real install spec; the absence of those in the manifest is inconsistent.

⚠ Instruction Scope

SKILL.md instructs automatic environment selection by checking a .env file for Browserbase keys and says selection occurs with 'No user prompting', implying the agent should read local config without asking. It also instructs running `npm install` and `npm link` and to use a persistent Chrome profile (.chrome-profile/) and agent download folder, which involves reading/writing local files, persisting cookies/sessions, and creating a global command — all outside a minimal 'read-only browse' scope and potentially exposing sensitive data (API keys, session cookies).

⚠ Install Mechanism

There is no formal install spec in the registry, but SKILL.md/setup.json explicitly instructs `npm install` and `npm link`. That would modify disk and create a global binary. The skill bundle itself contains no code files or package manifest, so `npm install` may fail here — but the instructions still encourage installing arbitrary Node dependencies which is a high-risk action because it can fetch and run code from the network and alter the host environment.

⚠ Credentials

The skill manifest claims no required env vars, yet the docs require/encourage ANTHROPIC_API_KEY and optionally BROWSERBASE_API_KEY and BROWSERBASE_PROJECT_ID. The instructions tell the agent to check .env automatically. Requesting model API keys and remote service keys is plausible for AI-driven automation, but the lack of declaration in the registry and the automatic, non-interactive checking of local .env is disproportionate and risks accidental credential exposure or silent use of remote services.

⚠ Persistence & Privilege

The setup flow recommends `npm link` to create a global 'browser' command (system-wide change) and uses a persistent Chrome profile directory (.chrome-profile/) that preserves cookies and sessions between runs. The skill does not set always:true, but the instructions still request persistent artifacts and global CLI installation which increases blast radius and privacy risk if installed without inspection.

版本历史

v1.0.0

Initial release of browser automation skill for CLI. - Automates web browser interactions using natural language commands via CLI. - Automatically selects between local Chrome and remote Browserbase environments based on configuration (no user prompting). - Provides commands for navigation, interacting with pages, data extraction, element discovery, screenshots, and browser closure. - Supports both quick start usage and detailed troubleshooting guidance. - Includes a table outlining feature differences between local and remote modes. - Best practices and setup instructions clearly documented.

元数据

Slug browser-pc

版本 1.0.0

许可证 —

累计安装 14

当前安装数 13

历史版本数 1

常见问题