Browser Cash
v1.0.0Spin up unblocked browser sessions via Browser.cash for web automation. Sessions bypass anti-bot protections (Cloudflare, DataDome, etc.) making them ideal for scraping and automation.
⭐ 4· 3.7k·18 current·18 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill name/description (remote, anti-bot bypassing browser sessions) aligns with the instructions for creating sessions and connecting to a CDP URL. However, the skill metadata declares no required credentials while the runtime instructions require an API key stored in Clawdbot config at skills.entries.browser-cash.apiKey—this is an omission in declared requirements. Requiring curl and jq is coherent with the provided curl/jq examples.
Instruction Scope
SKILL.md instructs the agent to: read/write Clawdbot config entries, run npm install in ~/clawd (installing playwright and puppeteer-core), execute Node code that connects to remote CDP WebSocket endpoints, and interact with Browser.cash APIs. These actions are within the scope of browser automation, but they include local package installs, execution of arbitrary Node snippets, and opening a bi-directional WebSocket to an externally hosted browser which can load arbitrary pages—each of which has operational and data-exfiltration implications the user should consider.
Install Mechanism
There is no formal install spec in the registry (instruction-only), which is lower registry risk, but the runtime instructions tell the agent to run npm install to fetch Playwright/puppeteer-core into ~/clawd/node_modules. That will download third‑party code and browser binaries from upstream registries/hosts at runtime (potentially large downloads). Because installation is performed via shell commands in SKILL.md rather than an audited install spec, this increases the surface area.
Credentials
The skill does not declare required environment variables or a primary credential in metadata, yet the instructions require an API key stored in Clawdbot config (skills.entries.browser-cash.apiKey) and reference it via BROWSER_CASH_KEY. This mismatch is a material omission: users must supply a secret (API key) but the skill metadata does not make that explicit. No other unrelated credentials are requested.
Persistence & Privilege
always is false and the skill is user-invocable only (normal). The skill recommends writing the API key into the agent's Clawdbot config (a persistent change to agent config). That is expected for a credential-based integration, but you should verify how the Clawdbot config is stored and who/what can read it.
What to consider before installing
Before installing or using this skill: (1) confirm you trust the Browser.cash service (it will receive your API key and run browser sessions), (2) be aware the SKILL.md expects you to store the API key in Clawdbot config (the registry metadata fails to declare this requirement), (3) the instructions install Playwright/puppeteer-core into ~/clawd and will download browser binaries and code from npm/Playwright hosts—review and approve those downloads, (4) the skill executes Node snippets that connect to remote CDP WebSocket endpoints; those remote browsers can load arbitrary pages and could be used to access or exfiltrate data you navigate to, so avoid using sensitive accounts or internal-only services without proper controls, (5) check company/legal policies about bypassing anti-bot protections and scraping, and (6) if you proceed, inspect and run the curl/npm/node commands manually in a controlled environment first rather than allowing full autonomous execution.Like a lobster shell, security has layers — review code before you run it.
automationvk97ancwe5hrbt0fn0e77vnda9s800kb8browservk97ancwe5hrbt0fn0e77vnda9s800kb8browser, scraping, automation, anti-detect, cdp, playwright, puppeteer, web, unblockedvk97ancwe5hrbt0fn0e77vnda9s800kb8cdpvk97ancwe5hrbt0fn0e77vnda9s800kb8latestvk97ancwe5hrbt0fn0e77vnda9s800kb8playwrightvk97ancwe5hrbt0fn0e77vnda9s800kb8scrapingvk97ancwe5hrbt0fn0e77vnda9s800kb8
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🌐 Clawdis
Binscurl, jq