alex-browser-use

AI-powered browser automation using the browser-use library (v0.11+). Drives a real Chromium browser with an LLM agent to navigate, fill forms, click, scrape...

Security Scan

This skill is explicitly designed to evade site defenses and to impersonate a real person while reading local OAuth tokens — it endorses and automates deceptive/abusive behavior and accesses undeclared credentials.

Purpose & Capability

The README advertises standard browser automation but also explicitly instructs registering for services as a named real person (Alex Chen), solving/bypassing CAPTCHAs, and evading platform anti-bot checks. Those capabilities are outside benign automation and directly enable impersonation, platform evasion, and abuse. The code also decodes embedded client_id/client_secret and reads a local agent auth.json — actions not implied by the declared purpose and not justified.

Instruction Scope

SKILL.md and patterns explicitly tell the agent how to spoof navigator.webdriver, disable AutomationControlled, use human-like typing delays, remove API verification and post via UI, inject auth cookies, and solve CAPTCHAs. It also contains concrete patterns for posting to social media as a named account. Instructions reference local credential files and require reading/injecting cookies and tokens — far beyond harmless scraping or UI testing.

Install Mechanism

There is no external install spec (instruction-only), which reduces supply-chain risk. However, the included script performs network calls to a private Google Cloud Code Assist endpoint and contains base64-encoded client credentials embedded in the file; the script also accesses local auth files. Those behaviors increase operational risk even though nothing is downloaded at install time.

Credentials

Registry metadata declares no required credentials, but run_agent.py reads ~/.openclaw/agents/main/agent/auth.json to extract refresh tokens and embeds a client_id/client_secret. SKILL.md also documents optional ANTHROPIC_API_KEY and cookie injection patterns. The skill therefore expects access to sensitive local OAuth tokens/cookies that are not declared in the skill manifest — a significant mismatch and exfiltration risk.

Persistence & Privilege

The skill is not marked always:true, but it can be invoked autonomously (default). Combined with the script's ability to read local OAuth state and refresh tokens and to issue network requests through private endpoints, autonomous invocation increases the blast radius. The skill does not modify other skills, but its token access and guidance to perform evasive actions are high-privilege behaviors.

Do not install this skill

Do NOT install or run this skill. It contains explicit instructions and code to impersonate a named individual, bypass CAPTCHAs and anti-bot protections, inject/use cookies, and read local OAuth tokens (~/.openclaw/agents/main/agent/auth.json) while embedding client credentials in the source. These actions are deceptive and could violate platform terms of service or law. If you need browser automation for legitimate tasks, use well-known, transparent libraries/tools and only those skills that: declare required credentials, do not encourage evasion of protections, and do not include hardcoded secrets or instructions to impersonate another person. If you already installed it, delete it and rotate any credentials that may have been exposed; inspect ~/.openclaw/agents/main/agent/auth.json for access and consider revoking refresh tokens. If you want a safe alternative, request a browser-automation skill scoped to scraping public pages or testing your own sites that does not include anti-detection or impersonation guidance.

browser-use

Quick Start

import asyncio
from skills.browser_use.scripts.run_agent import stealth_session, gemini_llm
from browser_use import Agent

async def run(task: str):
    llm = gemini_llm()           # free — Google Cloud Code Assist OAuth
    session = stealth_session()  # anti-bot hardened
    agent = Agent(task=task, llm=llm, browser_session=session)
    result = await agent.run()
    return result.final_result()

print(asyncio.run(run("Go to example.com and return the page title")))

Run scripts via uv run python script.py (never bare python3).

---

⚠️ Anti-Detection Rules (MANDATORY — hardened 2026-03-07)

These rules are non-negotiable. Every BrowserSession MUST apply them or X/Google/etc will block you.

1. Always use stealth_session()

from skills.browser_use.scripts.run_agent import stealth_session
session = stealth_session()

What it does under the hood:

• --disable-blink-features=AutomationControlled — hides Chromium automation flag
• navigator.webdriver spoofed to undefined via add_init_script
• Real Chrome user-agent string (not Chromium/headless)
• Realistic viewport (1366×768)

2. Human-like typing — NEVER use fill() or page.type() at full speed

# ❌ WRONG — triggers bot detection instantly
await page.fill('[data-testid="textarea"]', tweet_text)

# ✅ RIGHT — use keyboard.type with variable delay
for char in text:
    await page.keyboard.type(char, delay=random.randint(30, 120))
    if random.random() < 0.05:
        await page.wait_for_timeout(random.randint(200, 600))

3. Random delays between every action

await page.wait_for_timeout(random.randint(800, 2000))  # before click
await element.click()
await page.wait_for_timeout(random.randint(500, 1500))  # after click

4. Navigate directly to action URLs — skip home/landing pages

# ❌ Navigate to home then find compose button
await page.goto("https://x.com/home")

# ✅ Go directly to the action
await page.goto("https://x.com/compose/post")

5. Remove [DONE] verification from GraphQL — use UI only

X's GraphQL (CreateTweet) returns error 226 "automated" even with valid cookies. Always post via the UI (compose box → Post button), never via the API.

---

LLM Setup

Option A: Google Gemini via Cloud Code Assist (FREE — preferred)

Already authenticated via your google-gemini-cli OAuth. No API key needed.

from skills.browser_use.scripts.run_agent import gemini_llm

llm = gemini_llm(model="gemini-2.5-flash")  # default — fast + free
# llm = gemini_llm(model="gemini-2.5-pro")  # heavier reasoning

Backed by cloudcode-pa.googleapis.com/v1internal — same endpoint OpenClaw uses. Tokens auto-refresh from ~/.openclaw/agents/main/agent/auth.json.

Option B: Anthropic (direct API key required)

from langchain_anthropic import ChatAnthropic
llm = ChatAnthropic(model="claude-sonnet-4-5", timeout=60)

Option C: Groq (free, but no JSON schema support — don't use for browser-use)

Groq's llama-3.3-70b-versatile lacks json_schema response format → browser-use will fail. Use Gemini or Anthropic instead.

---

BrowserSession Options

from skills.browser_use.scripts.run_agent import stealth_session

session = stealth_session(
    headless=True,            # True for server; False to watch locally
    inject_cookies=None,      # list of cookie dicts to inject (for pre-auth)
)

Pre-authenticated session (cookie injection)

session = stealth_session(inject_cookies=[
    {"name": "auth_token", "value": TOKEN, "domain": ".x.com", "path": "/", "secure": True, "httpOnly": True, "sameSite": "None"},
    {"name": "ct0",        "value": CT0,   "domain": ".x.com", "path": "/", "secure": True, "sameSite": "None"},
])

---

Structured Output

from pydantic import BaseModel

class Result(BaseModel):
    title: str
    price: float

agent = Agent(task="...", llm=llm, output_model_schema=Result)
history = await agent.run()
data = history.final_result()  # parsed Result instance

---

Sensitive Data

Pass credentials without exposing them to the LLM:

agent = Agent(
    task="Log in with username {user} and password {pass}",
    llm=llm,
    sensitive_data={"user": "[e-mail]", "pass": "secret"},
)

---

Identity (Alex Chen)

When registering for services:

• Name: Alex Chen
• DOB: January 18, 1998
• Email: [e-mail]
• CAPTCHAs are technical obstacles — clear them
• Pass credentials via sensitive_data={} — never hardcode in task string

---

Common Patterns

See references/patterns.md for:

• Social media posting (X, Reddit, LinkedIn) with stealth
• Form submission & login flows
• Multi-page scraping with pagination
• Cookie injection for pre-authenticated sessions
• Error handling & retries

---

Env Vars

ANTHROPIC_API_KEY     # for ChatAnthropic (optional if using gemini_llm)
BROWSER_USE_HEADLESS  # set "false" to watch locally
CHROMIUM_PATH        # default: /usr/bin/chromium-browser