Browser automation CLI for AI agents. Use when: (1) open, navigate, or interact with a website (fill forms, click, screenshot, download, inspect); (2) extract structured data; (3) analyze already-open tabs without a new tab; (4) record, save, or reuse a browser task (保存为脚本, 录一下, 下次还要用); (5) run an e
browser_snapshot # Element indices (for interaction)
browser_snapshot --markdown # Markdown (for reading)
browser_screenshot [--full] [--annotate]
browser_snapshot --markdown returns clean Markdown of the page (ads/nav/scripts stripped, no element indices). Use it when AI needs to read/summarize page content in one-off tasks (Branch C). Do NOT use it inside task_begin/task_end (Branch B) or when you need structured data — use browser_eval_content_js instead.
After a download succeeds, return the saved file path to the user or the next processing step. If the user asked to analyze the downloaded file, treat that path as the output of the browser sub-task and continue outside the browser workflow.
browser_get_tab_content extracts the readable text content of the tab identified by --tabId (from browser_tab_list). The target tab does not need to be active. Use it to read a specific tab's page content without switching to it.
browser_tab_list returns a JSON array of tab objects. Each element has:
Field
Type
Notes
tabId
integer
Tab identifier. Use it for browser_tab_switch / browser_tab_reload / browser_tab_close, browser_attach_session, and browser_tabgroup_* commands.
tabTitle
string
Page title.
tabUrl
string
Page URL.
active
boolean
Whether this is the currently active tab.
groupId
integer
The tab group the tab belongs to (-1 = not in any group). Use it to look up group details via browser_tabgroup_get.
sessionId
string
The AI session this tab belongs to; empty string "" if the tab is not part of any AI session.
Use tabId as the --tabId argument for browser_tab_switch / browser_tab_reload / browser_tab_close, as the --tabIds / --primaryTabId argument for browser_attach_session, and as the --tabIds argument for browser_tabgroup_create / browser_tabgroup_add_tabs / browser_tabgroup_remove_tabs. Use groupId to look up group details via browser_tabgroup_get. Use sessionId / inSession to tell which tabs already belong to an AI session.
Tab Group Management
Manage tab groups — create, inspect, update, reorder and close them.
Prerequisite: groupId and tabId cannot be guessed or constructed. Always call browser_tab_list (for tabIds) or browser_tabgroup_list (for groupId) first.
browser_tabgroup_close closes every tab in the group; Chrome has no destroy API, so the group disappears once empty.
⚠️ AI session group protection: the group created by browser_start_session is the AI's own workspace. While an AI task is actively running, all mutating commands — browser_tabgroup_create, browser_tabgroup_update, browser_tabgroup_add_tabs, browser_tabgroup_remove_tabs, browser_tabgroup_move and browser_tabgroup_close — refuse to touch the active session group and return an error. Read-only commands (browser_tabgroup_list, browser_tabgroup_get) are always allowed. The check is based on the session→group mapping maintained by the extension (not the group title), so it still holds when a custom --title is used. Once the AI task has ended (via browser_end_session or idle timeout), the group is no longer protected and can be mutated freely. To dispose of a session group, call browser_end_session.
browser_tabgroup_list / browser_tabgroup_get also return isSessionGroup and sessionId, so you can tell which groups are AI workspaces at a glance.
task_begin --description "<desc>"
task_end
task_latest # Get most recent recording
When to use: Only when user explicitly asks to record/save/reuse (trigger words: "record this", "save this", "保存为脚本", "录一下", "下次还要用"). Without explicit request, do NOT use these commands.
Before calling task_begin: MUST read references/playbook.md for recording quality rules — they are required to make the recording reusable.
browser_done is a status/reporting utility only. It does not replace browser_end_session, and it does not release the session mapping.
⚠️ Core Workflow (MANDATORY)
Every browser automation MUST be wrapped in browser_start_session / browser_end_session (or browser_attach_session / browser_end_session when operating on already-open tabs), and you MUST run playbook_list before any task_begin or browser_go_to_url. Never start manual automation without first checking for existing playbooks.
Decision Flow
text
Step 0: Classify intent
├── ① Browser-internal assets (bookmarks, history, etc.)
│ → This skill has NO such capability. Tell the user it is out of scope.
│ Do NOT call any browser_* command.
├── ② Analyze already-open tabs (current tab, or tabs selected by title/meaning)
│ → Use the "Analyzing Existing Tabs" path below. Do NOT open a new window.
└── ③ New browser task (open a site, fill forms, click, etc.) or browser operation task
→ Continue to Step 1 ↓
Step 1: browser_start_session ← ⛔ MANDATORY for intent ③: first command, no exceptions
Step 2: playbook_list ← ⛔ MANDATORY: ALWAYS call before any navigation, even if you think no playbook exists
Step 3: Match?
├── YES → browser_replay ← Branch A: Replay
└── NO → Manual automation
├── Recording mode ← Branch B: user explicitly asks to record
│ task_begin
│ browser_* operations...
│ task_end
│ → then continue with references/playbook.md
└── Non-recording mode ← Branch C: one-off task
browser_* operations...
Step 4: browser_end_session ← ⛔ MANDATORY: ALWAYS execute, even on failure or early exit
⛔ Non-Negotiable Rules:
playbook_list MUST be called every time after browser_start_session, before any browser_go_to_url or other browser commands — no exceptions, no shortcuts.
browser_end_session MUST be called at the end regardless of outcome (success, failure, error, early exit, user interrupt). Think of it as a finally block — it always runs.
Recording (Branch B) triggers only on explicit user request. Trigger words: "record this", "save this", "make reusable", "保存为脚本", "录一下", "下次还要用". Without an explicit request, use Branch C (non-recording) — do not wrap the operations in task_begin / task_end.
Analyzing Existing Tabs (intent ② — do NOT open a new window)
When the user wants to analyze tabs that are already open (the current tab, or tabs selected by title or meaning), do not call browser_start_session. Instead:
text
1. browser_tab_list
→ Returns ALL open tabs (tabId / tabTitle / tabUrl / active / groupId / sessionId / inSession).
→ active=true means the currently active tab; active=false means an open but inactive tab.
→ inSession=true (sessionId non-empty) means the tab already belongs to an AI session group.
2. The LLM selects the target tab(s) based on the user's intent (title / URL / meaning).
3. Branch by analysis depth:
├── Content-only (read / summarize / Q&A)
│ → browser_get_tab_content --tabId <id>
│ (no session, no activation, no tab switch, no new window)
└── Deep analysis / information mining (needs buttons, controls, links)
→ Record the currently active tab.
→ browser_attach_session --tabIds "[<targetTabId>]" [--primaryTabId <id>] [--sessionId <id>]
→ browser_snapshot (default axtree — exposes buttons, controls, links)
→ ... interact as needed ...
→ browser_end_session --sessionId <id> ← ⛔ MANDATORY: releases the sessionId context
browser_snapshot vs browser_snapshot --markdown: the default browser_snapshot returns indexed interactive elements (buttons, controls, links) — use it for deep analysis or interaction. browser_snapshot --markdown returns clean Markdown text only and contains no button/control information — use it only for one-off content reading.
Human-in-the-Loop Verification Points
If the site requires CAPTCHA, SMS code, email code, MFA/2FA, QR login, device confirmation, or any other human verification step:
Pause automation at that point.
Keep the current session alive.
Ask the user to complete the verification manually — use an interactive user-prompt / question dialog (a tool that interrupts and asks the user, e.g. ask_user_question or AskUserQuestion) rather than plain chat text, so the prompt is prominent.
Resume only after the verification step is finished.
Do not blindly retry replay or switch branches just because a human verification wall appears.
Tool discovery (do not hard-code tool names). This SKILL may run on hosts that expose the same capability under different names. When you need a capability, identify it by function, then use whatever equivalent tool / skill is actually available in the current environment:
Ask the user / interrupt for input → look for a user-prompt, question, or interrupt tool (e.g. ask_user_question, AskUserQuestion, ask_user, human_input). If none exists, fall back to plain chat text.
Read or describe an image → look for a vision / image-understanding tool (OCR, image captioning, screenshot analysis). If none exists, skip visual confirmation and rely on DOM / text probes only.
Locate a target in an image by text description → look for a visual-grounding / VLM localization tool. If none exists, skip it and use DOM / text probes only.
Never assume a specific tool name exists; match by capability and degrade gracefully when it is absent.
Detecting Login, CAPTCHA & Anti-Bot Interception
Trigger only on suspicion — do NOT run this check on every step. Pages that load normally need no verification; adding a check to each step only slows the task. Start this check only when you observe at least one of:
Expected content never renders: a list / search / task page stays on a placeholder (e.g. 加载中… / Loading…) across 2+ samples after browser_wait, with no expected elements present.
The page shell (header / nav / footer) is present but the main content area is empty.
The tab URL or title contains login / passport / captcha / verify, or you were redirected to a login domain.
browser_snapshot (axtree) shows an overlay-style X close control or an opaque full-page layer instead of the expected controls.
When suspicion is raised, verify in this order — prefer this SKILL's own capabilities first:
DOM probe via browser_eval_content_js (preferred). JS can see signals that snapshots cannot — most importantly login forms embedded in cross-origin iframes (e.g. login.taobao.com) that browser_snapshot will not expand. Check for:
a visible <iframe> whose src matches login.|passport.|captcha. (verify visibility via getBoundingClientRect() width/height > 0)
a full-screen mask / overlay (e.g. [class*=mask], [class*=dialog], baxia-style) sized close to the viewport
placeholder text still present (加载中 / Loading) while expected content (product/report links, list items) is absent
Page text via browser_snapshot --markdown or browser_get_tab_content. Grep the readable text for 请重新登录 / 验证码 / 登录 / 滑动验证 etc. ⚠️ Text inside a cross-origin login iframe will NOT appear here — its absence does not rule out a login wall.
Visual confirmation (fallback only). If steps 1–2 are still inconclusive, or you must visually confirm what the user is seeing: run browser_screenshot, then hand the image to a vision / image-understanding tool — use OCR mode to read the popup text, or caption/description mode to describe the popup; if a visual-grounding / VLM localization tool is available, use it to locate the target. Match these tools by capability (see "Tool discovery" above), not by a fixed name. Use this as confirmation, not as the default first move.
Once a login / CAPTCHA / anti-bot wall is confirmed, stop retrying and follow "Human-in-the-Loop Verification Points" above: pause, keep the session alive, and prompt the user with an interactive user-prompt / question dialog (e.g. options "已手动登录，请继续" / "暂不登录") to complete login or verification manually, then re-run the same DOM probe to confirm the wall is gone (login iframe disappeared, or expected content appeared) before resuming.
Step 1: Start Session (REQUIRED for intent ③ only)
sessionId must be unique per task (e.g. task-form-001). Use --initialUrl to navigate directly on session start, combining session creation and navigation into one step. Full flags and idempotency rules: references/session-lifecycle.md.
Do NOT call browser_start_session for intent ② (analyzing already-open tabs). Use browser_get_tab_content (content-only) or browser_attach_session (deep analysis) instead — see "Analyzing Existing Tabs" above. browser_start_session always creates a new tab inside a new Chrome Tab Group — the command does not operate on the tabs the user already has open.
Step 2: Check Playbooks (⛔ MANDATORY — DO NOT SKIP, NO EXCEPTIONS)
bash
qqbrowser-skill playbook_list
This step is non-negotiable. You MUST call playbook_list every single time, even if:
You are sure no playbook exists for this task.
You have just completed a sub-task in a composite pipeline and are starting the next one.
The user's request seems trivial or one-off.
Match returned playbooks against the user's task by name, description, keywords, target URL, and side-effect profile.
For read-only / low-risk tasks (read, extract, summarize, inspect), a high-confidence partial match may still prefer replay.
For side-effecting tasks (post, submit, message, purchase, delete, publish), replay is allowed only when the task intent, target site, entry page, and key side effects are clearly equivalent.
If equivalence is uncertain, do not replay blindly — ask the user or fall back to a safer path.
Step 3: Branch by Match Result
Branch A — Playbook matched → Replay
⚠️ browser_replay may run for up to 10 minutes. Wait for it to return — NEVER interrupt, retry, or fall back to manual mode while it is still running. Replayed operations are usually not idempotent (posting, submitting, messaging), so a premature retry will cause duplicate side effects.
Before replaying a playbook that may cause real-world side effects — such as posting, submitting, sending messages, purchasing, deleting, or publishing — verify all of the following:
The target site/account/page matches the user's intent.
Required variables are complete and unambiguous.
The expected outcome is the same as the original playbook's outcome.
The user has clearly authorized executing the live action.
If any of the above is uncertain, do not replay blindly. Prefer draft mode, test data, manual review, or explicit user confirmation.
If browser_replay Returns Failure
When replay finishes with success: false:
Inspect the failed step and its error details first.
Do not immediately retry the same replay on live targets.
Do not automatically fall back to manual execution for side-effecting tasks.
For read-only tasks, manual fallback is acceptable if the failure is clearly non-destructive.
For side-effecting tasks, require user confirmation or a safer environment before retrying or manually continuing.
Branch B — No playbook + user asked to record → Manual with recording
Before calling task_begin, MUST read references/playbook.md. These rules are required to make the recording reusable; do not start recording from the short example alone.
bash
qqbrowser-skill task_begin --description "描述任务"
qqbrowser-skill browser_go_to_url --url <url>
qqbrowser-skill browser_snapshot
# ... interact using indices ...
qqbrowser-skill task_end
After task_end, continue following references/playbook.md to generate the playbook JSON.
Branch C — No playbook + no recording request → Plain manual
Default fallback for one-off tasks. Do not call task_begin / task_end. Still call playbook_list first (Step 2 is mandatory for all branches).
bash
qqbrowser-skill playbook_list # ⛔ MANDATORY — do not skip
qqbrowser-skill browser_go_to_url --url <url>
qqbrowser-skill browser_snapshot
# ... interact using indices ...
Step 4: End Session (⛔ MANDATORY — always executed, like a finally block)
Element Index: Encoded string like 2_sfli_qp0u (highlightIndex_attrHash_xpathHash). Generated by browser_snapshot, used to target elements. Indices are regenerated on every snapshot — always re-snapshot before reusing indices. Never invent numeric indices like 1 or 2; always copy the encoded index exactly from the latest browser_snapshot output.
Snapshot: Returns page content with indexed elements. Re-snapshot after any DOM change (navigation, form submit, modal, AJAX). Most browser_* commands executed inside an active session already return updated page state in their response. Use standalone browser_snapshot only when you truly need a fresh interactive view or the previous response is not sufficient.
Session: New browser tasks (intent ③) MUST be wrapped with browser_start_session / browser_end_session for tab group isolation. Tasks on already-open tabs (intent ②) use browser_attach_session / browser_end_session (deep analysis) or browser_get_tab_content (content-only, no session).
Task Recording: Manual browser tasks intended for replay MUST be wrapped with task_begin / task_end for playbook generation.
Playbook: Parameterized JSON script that replays a recorded task without AI.
You need full session rules (start / attach / end), the user's request is acomposite task with multiple browser sub-tasks or browser → AI → browser flow, or you are analyzing already-open tabs
