Functions
ReviewAudited by ClawScan on May 1, 2026.
Overview
This is a coherent Browserbase Functions deployment guide, but users should notice that it involves npm/CLI execution, Browserbase API keys, and publishing cloud browser automation.
Install this only if you intend to let Claude help create and deploy Browserbase Functions. Before running commands, verify the npm package source, protect Browserbase and website credentials, review the function code, and confirm before publishing or invoking cloud automation.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Running the setup command executes package code on the user's machine and may install dependencies in the project.
The guide instructs users to fetch and execute the Browserbase functions package through pnpm. This is central to the skill's stated purpose, but users should recognize that package-manager execution depends on the package source and version available at install time.
pnpm dlx @browserbasehq/sdk-functions init my-function
Use the official package source, run commands only in the intended project directory, and consider pinning package versions for reproducible deployments.
The API key may allow publishing, invoking, or consuming resources in the user's Browserbase account.
The skill requires Browserbase account credentials even though the registry metadata declares no required env vars or primary credential. This is expected for deploying to Browserbase, but it gives the workflow authority over the user's Browserbase project.
export BROWSERBASE_API_KEY="your_api_key" export BROWSERBASE_PROJECT_ID="your_project_id"
Use a least-privilege Browserbase key where possible, keep .env files out of version control, and rotate the key if it may have been exposed.
A published function can create cloud-side automation that may incur usage, expose an invocation surface, or run code against websites and accounts.
The guide includes a command to publish a function to Browserbase. Publishing cloud automation is exactly the skill's purpose, but it is a state-changing external action.
pnpm bb publish index.ts
Review the function code before publishing, confirm the intended Browserbase project, and understand how to disable or remove the deployed function if needed.
If users adapt this pattern, their site credentials may be sent through the function invocation path and used by a remote browser session.
The authenticated-action example shows passing website login credentials into a cloud browser automation function. This can be a legitimate automation pattern, but it involves sensitive credentials and third-party account access.
await page.fill('[name="email"]', params.email);
await page.fill('[name="password"]', params.password);Avoid sending unnecessary passwords, prefer scoped tokens or test accounts where possible, and ensure the function endpoint and parameters are protected.