Plasmate

Browse the web via Plasmate, a fast headless browser engine for agents. Compiles HTML into a Semantic Object Model (SOM) - 50x faster than Chrome, 10x fewer...

Security Scan

The skill's code and instructions match its stated purpose (local headless browsing via the plasmate binary); the main risks are a remote install script (curl | sh) and an undeclared runtime pip install in the helper script, both of which are explainable but worth reviewing before use.

Purpose & Capability

Name/description, required binary (plasmate), install options, and the included Python AWP client all align: the skill exists to control a local Plasmate server. There are no unexpected credentials, unrelated binaries, or external services required.

Instruction Scope

SKILL.md and scripts limit actions to starting/connecting to a local Plasmate server and issuing AWP/CDP commands. They do not attempt to read unrelated system files or exfiltrate data. One scope mismatch: the Python client auto-installs the 'websockets' pip package at runtime if missing; this side-effect is not documented in SKILL.md metadata and will modify the environment.

Install Mechanism

Two install options are provided: 'cargo install plasmate' (build from source) and 'curl -fsSL https://plasmate.app/install.sh | sh' (run remote installer). The remote-install pattern (pipe-to-sh) is convenient but inherently risky — it executes a script fetched from the network. The domain is the project's official site (plasmate.app), which reduces suspicion, and a source/build option is available, lowering risk further.

Credentials

The skill does not request credentials, environment variables, or config paths. The only noteworthy environment access is starting a local server on a standard localhost port and the helper script's ability to pip-install a dependency (network access to PyPI). Those are proportionate to running a local headless browser client.

Persistence & Privilege

The skill is not always-enabled and does not request elevated platform privileges. It may start a local 'plasmate serve' process (expected behavior) but does not modify other skills or system-wide agent settings.

Assessment

This skill appears to do what it says: control a local Plasmate headless browser. Before installing, consider: 1) Prefer building from source (cargo install) if you need stronger assurance; 2) If you use the 'curl | sh' installer, review the install script at https://plasmate.app/install.sh to ensure it does what you expect; 3) The provided Python helper will pip-install the 'websockets' package if missing — that modifies your Python environment and reaches out to PyPI; run it in a virtualenv or sandbox if you want to avoid global changes; 4) The Plasmate server listens on localhost (9222 by default) — if you run other local tools that connect to that port, be aware they could interact with the same server; 5) Verify the upstream project (GitHub/source) and the integrity of downloaded binaries if you require higher assurance.

Plasmate - Browser Engine for Agents

Plasmate compiles HTML into a Semantic Object Model (SOM). 50x faster than Chrome, 10x fewer tokens.

• Docs: https://docs.plasmate.app
• Source: https://github.com/plasmate-labs/plasmate (Apache 2.0)
• Privacy: All processing runs locally. No telemetry or cloud services.

Install

# Build from source (recommended)
cargo install plasmate

# Or use the install script
curl -fsSL https://plasmate.app/install.sh | sh

Protocols

• AWP (native): 7 methods - navigate, snapshot, click, type, scroll, select, extract
• CDP (compatibility): Puppeteer/Playwright compatible on port 9222

Default to AWP. Use CDP only when existing Puppeteer/Playwright code needs reuse.

Quick Start

Fetch (one-shot, no server)

plasmate fetch <url>

Returns SOM JSON: regions, interactive elements with stable IDs, extracted content.

Server Mode

# AWP (recommended)
plasmate serve --protocol awp --port 9222

# CDP (Puppeteer compatible)
plasmate serve --protocol cdp --port 9222

AWP Usage (Python)

Run scripts/awp-browse.py for AWP interactions:

# Navigate and get SOM snapshot
python3 scripts/awp-browse.py navigate "https://example.com"

# Click an interactive element by ref ID
python3 scripts/awp-browse.py click "https://example.com" --ref "e12"

# Type into a field
python3 scripts/awp-browse.py type "https://example.com" --ref "e5" --text "search query"

# Extract structured data (JSON-LD, OpenGraph, tables)
python3 scripts/awp-browse.py extract "https://example.com"

# Scroll
python3 scripts/awp-browse.py scroll "https://example.com" --direction down

CDP Usage (Puppeteer)

When CDP is needed, connect Puppeteer to the running server:

const browser = await puppeteer.connect({
  browserWSEndpoint: 'ws://127.0.0.1:9222'
});
const page = await browser.newPage();
await page.goto('https://example.com');
const content = await page.content();

SOM Output Structure

SOM is a structured JSON representation, NOT raw HTML. Key sections:

• regions: Semantic page areas (nav, main, article, sidebar)
• interactive: Clickable/typeable elements with stable ref IDs (e.g., e1, e12)
• content: Text content organized by region
• structured_data: JSON-LD, OpenGraph, microdata extracted automatically

Use ref IDs from interactive elements for click/type actions.

Performance

Metric	Plasmate	Chrome
Per page	4-5 ms	252 ms
Memory (100 pages)	~30 MB	~20 GB
Output size	SOM (10-800x smaller)	Raw HTML

When to Use Plasmate vs Browser Tool

• Plasmate: Speed-critical scraping, batch page processing, token-sensitive extraction, structured data
• Browser tool: Visual rendering needed, screenshots, complex JS SPAs requiring full Chrome engine, pixel-level interaction