← 返回 Skills 市场
stealthy-auto-browse
作者
Ciprian Mandache
· GitHub ↗
· v2.0.0
· MIT-0
3001
总下载
2
收藏
6
当前安装
13
版本数
在 OpenClaw 中安装
/install stealthy-auto-browse
功能描述
Browser automation that passes CreepJS, BrowserScan, Pixelscan, and Cloudflare — zero CDP exposure, OS-level input, persistent fingerprints. Use when standar...
安全使用建议
This skill is internally consistent with its stated purpose, but it asks you to pull and run a third‑party Docker image and to expose VNC/HTTP ports and persistent profile data — actions that carry real risk. Before installing: 1) Inspect and vet the Docker image (psyb0t/stealthy-auto-browse) and its Dockerfile/entrypoint on its GitHub repo; 2) Avoid running the image as root or on a sensitive host; run in a hardened environment or sandbox; 3) Do not pass secrets via PROXY_URL or mount sensitive host paths unless you trust the image; 4) If the server requires AUTH_TOKEN, store and supply it securely (the skill uses AUTH_TOKEN env var). If you cannot verify the image provenance or code, treat this skill as untrusted and avoid running it on production machines.
功能分析
Type: OpenClaw Skill
Name: stealthy-auto-browse
Version: 2.0.0
The skill provides high-risk browser automation capabilities specifically designed to bypass security controls like Cloudflare and DataDome using stealth techniques (Camoufox, PyAutoGUI for OS-level input). It includes actions for extracting sensitive data such as cookies and local storage, as well as an 'eval' action for arbitrary JavaScript execution (SKILL.md). While these features align with the stated purpose of stealthy scraping, they represent a significant attack surface for automated abuse or session theft. The inclusion of a cluster mode with Redis-based cookie synchronization (references/setup.md) and a parallel search orchestrator (scripts/websearch.py) further increases the potential for large-scale automated misuse.
能力标签
能力评估
Purpose & Capability
Name/description (stealth browser to bypass bot detection) aligns with the SKILL.md and scripts: the skill expects to drive a browser in Docker, use PyAutoGUI-like OS input, expose VNC, and present an HTTP API for actions. Required binaries (docker, curl) are reasonable for that purpose.
Instruction Scope
SKILL.md confines behavior to controlling a containerized browser via an HTTP API (goto, click, system_input, screenshots, etc.). It documents server-side AUTH_TOKEN and use of proxies, persistent profiles, and VNC. The instructions do include 'system' (OS-level) input and VNC exposure — these are coherent with the goal but increase the attack surface and require operator caution. The runtime instructions do not instruct the agent to read unrelated host files or secrets.
Install Mechanism
There is no formal install spec, but the docs explicitly tell you to run a Docker image (psyb0t/stealthy-auto-browse) and to download a docker-compose file from raw.githubusercontent.com. Pulling and running an untrusted third-party Docker image (and executing their compose file) is a high-risk operation — it can run arbitrary code on your host. The skill does not supply a package provenance or signed release instructions.
Credentials
Registry metadata lists STEALTHY_AUTO_BROWSE_URL as the primary credential — that's actually a base URL (not a secret). The included scripts and docs additionally reference AUTH_TOKEN (server bearer token), PROXY_URL (may include credentials), and optional USER_AGENT/WEBSEARCH_ENGINES. Requesting a URL and an optional server token is proportionate, but be aware PROXY_URL may contain credentials and persistent profile volumes can expose cookies/sessions.
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and is user-invocable. It recommends running a long-running Docker container and optionally mounting persistent profile volumes; that is normal for this use-case but grants the container persistent state and network access that you should trust only from a vetted image.
如何使用
- 确保已安装 OpenClaw(本地或 Docker 部署)
- 在对话框中输入安装命令:
/install stealthy-auto-browse - 安装完成后,直接呼叫该 Skill 的名称或使用
/stealthy-auto-browse触发 - 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v2.0.0
No file or documentation changes detected in this version.
v1.9.0
**Input guidance and workflow recommendations improved for input modes.**
- Now recommends using Playwright's `click` (CSS selector) first for most clicks—faster and more reliable.
- Clearly explains that `system_click` should only be used when sites detect/block DOM events and that it requires calibration for coordinates.
- Updated advice on when to use `fill` vs. `system_type` for form input.
- Typical workflow updated to prioritize selector-based actions, with explicit fallback to system-level input only when strictly necessary.
- No breaking changes to API or features.
vv1.8.0
- Added a new script: scripts/websearch.py.
- Introduces new functionality related to web searching.
v1.7.0
Version 1.7.0
- Added support for API authentication via `Authorization: Bearer <key>` header or `auth_token` query parameter if `AUTH_TOKEN` is set on the server.
- Documented automatic request serialization in single-instance mode (requests are queued and run one at a time).
- No file changes detected; changes are documentation improvements and clarifications in SKILL.md.
v1.6.0
stealthy-auto-browse 1.6.0 introduces console log capture capabilities.
- Added actions to enable, get, clear, and disable browser console logs, allowing retrieval of console messages (`console.log`, `console.error`, `console.warn`, etc.) with details including type, text, location, and timestamp.
- New actions documented: `enable_console_log`, `get_console_log`, `clear_console_log`, `getclear_console_log`, `disable_console_log`.
- No breaking changes to existing features.
v1.5.0
- Added setup instructions and configuration details in a new [references/setup.md](references/setup.md) file.
- Updated skill documentation for clarity, brevity, and organization.
- Streamlined usage examples and input mode explanations.
- Clarified when to use system (undetectable) vs. Playwright (detectable) input actions.
- Consolidated API action references and improved quick-start workflow guidance.
v1.4.0
add script mode
v1.3.0
better wording
v1.2.1
Rewrite SKILL.md as a proper usage guide instead of a dry API reference
- Every action now explains what it actually does, not just a terse
label
- Documented response data fields for all actions so agents know what
comes back
- Explained the difference between system_click, mouse_click, and click
(three ways to click, different tradeoffs)
- Added parameter details (required/optional, defaults, valid values)
for every action
- Included example response JSON for complex returns
(get_interactive_elements, get_network_log, get_cookies, list_tabs,
get_last_dialog, get_last_download)
- Added "When to use which" decision guide for system vs Playwright
input
- Documented gotchas: handle_dialog timing, calibrate after fullscreen,
upload_file still needs form submit, storage is per-origin
- Added full workflow section showing the typical interaction sequence
- Documented container options, pre-installed extensions, page loaders
with match rule logic
v1.2.0
New actions:
- Tabs: list_tabs, new_tab, switch_tab, close_tab
- Dialogs: handle_dialog, get_last_dialog (alert/confirm/prompt)
- Cookies: get_cookies, set_cookie, delete_cookies
- Storage: get_storage, set_storage, clear_storage (local + session)
- Downloads: get_last_download
- Uploads: upload_file (Playwright set_input_files)
- Network: enable/disable/get/clear_network_log
- Waits: wait_for_element, wait_for_text, wait_for_url,
wait_for_network_idle
- Proxy: PROXY_URL environment variable for HTTP proxy support
- XPath selector support (xpath= prefix) on all element actions
v1.1.0
**stealthy-auto-browse 1.1.0 — Improved documentation, new usage guidance, and enhanced setup instructions**
- Rewrote and reorganized documentation for clarity, including sections for when and when not to use this skill.
- Added a detailed comparison with standard browser automation to highlight stealth advantages (no CDP exposure, OS-level input).
- Clarified the setup process and included OpenClaw config and environment variable examples.
- Expanded API examples with precise JSON payloads and usage tips for undetectable interaction.
- Added container run examples for custom resolutions, timezones, persistent profiles, and URL auto-start.
- Revised tips and best practices for maximizing stealth when automating sites with anti-bot protections.
v1.0.1
remove runtime resulution setters
v1.0.0
Initial release of stealthy-auto-browse: control a stealthy browser that evades bot detection using OS-level mouse/keyboard input.
- Control a headless Firefox browser (Camoufox) that avoids common bot detection methods.
- Supports both "system" (OS-level, undetectable) and Playwright (detectable) input modes.
- Full API for navigation, mouse, keyboard, scrolling, screenshots, and state queries.
- Includes workflow for undetectable interaction: navigate, discover elements and coordinates, perform mouse/keyboard input at the OS level.
- Requires running the `stealthy-auto-browse` Docker container and setting `STEALTHY_AUTO_BROWSE_URL`.
元数据
常见问题
stealthy-auto-browse 是什么?
Browser automation that passes CreepJS, BrowserScan, Pixelscan, and Cloudflare — zero CDP exposure, OS-level input, persistent fingerprints. Use when standar... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 3001 次。
如何安装 stealthy-auto-browse?
在 OpenClaw 或 Claude Code 对话框中运行命令「/install stealthy-auto-browse」即可一键安装,无需额外配置。
stealthy-auto-browse 是免费的吗?
是的,stealthy-auto-browse 完全免费,采用 MIT-0 许可证,可自由下载、安装和使用。
stealthy-auto-browse 支持哪些平台?
stealthy-auto-browse 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。
谁开发了 stealthy-auto-browse?
由 Ciprian Mandache(@psyb0t)开发并维护,当前版本 v2.0.0。
推荐 Skills