Browser Automation CLI

Automate web browser interactions using natural language via CLI commands. Use when the user asks to browse websites, navigate web pages, extract data from websites, take screenshots, fill forms, click buttons, or interact with web applications.

Security Scan

The skill's documentation describes browser automation but its runtime instructions and setup contradict the declared manifest (it expects API keys, tells the agent to read .env automatically, and instructs global npm install/link), which is disproportionate and could expose secrets or modify the host without clear justification.

Purpose & Capability

Name/description claim simple browser automation. However the included docs reference requiring an ANTHROPIC_API_KEY and optional Browserbase keys (BROWSERBASE_API_KEY, BROWSERBASE_PROJECT_ID) and an npm-installed CLI. The registry metadata declares no required env vars or binaries — that mismatch is unexplained. A legitimate CLI-based browser skill would reasonably need an API key for the model or Browserbase creds and a real install spec; the absence of those in the manifest is inconsistent.

Instruction Scope

SKILL.md instructs automatic environment selection by checking a .env file for Browserbase keys and says selection occurs with 'No user prompting', implying the agent should read local config without asking. It also instructs running `npm install` and `npm link` and to use a persistent Chrome profile (.chrome-profile/) and agent download folder, which involves reading/writing local files, persisting cookies/sessions, and creating a global command — all outside a minimal 'read-only browse' scope and potentially exposing sensitive data (API keys, session cookies).

Install Mechanism

There is no formal install spec in the registry, but SKILL.md/setup.json explicitly instructs `npm install` and `npm link`. That would modify disk and create a global binary. The skill bundle itself contains no code files or package manifest, so `npm install` may fail here — but the instructions still encourage installing arbitrary Node dependencies which is a high-risk action because it can fetch and run code from the network and alter the host environment.

Credentials

The skill manifest claims no required env vars, yet the docs require/encourage ANTHROPIC_API_KEY and optionally BROWSERBASE_API_KEY and BROWSERBASE_PROJECT_ID. The instructions tell the agent to check .env automatically. Requesting model API keys and remote service keys is plausible for AI-driven automation, but the lack of declaration in the registry and the automatic, non-interactive checking of local .env is disproportionate and risks accidental credential exposure or silent use of remote services.

Persistence & Privilege

The setup flow recommends `npm link` to create a global 'browser' command (system-wide change) and uses a persistent Chrome profile directory (.chrome-profile/) that preserves cookies and sessions between runs. The skill does not set always:true, but the instructions still request persistent artifacts and global CLI installation which increases blast radius and privacy risk if installed without inspection.

What to consider before installing

Do not run the suggested setup steps blindly. Key warnings: - Manifest vs docs mismatch: the registry says no env vars required but the docs expect ANTHROPIC_API_KEY and optional Browserbase keys. Treat those as sensitive secrets. - The SKILL.md instructs reading a local .env automatically without prompting — that could expose API keys or other secrets. Ensure the agent is not allowed to read .env or other config files unless you explicitly permit it. - The instructions recommend `npm install` and `npm link`, which will fetch and install Node packages and create a global command. Inspect any package.json and the source code first (and prefer not to run npm link globally) because this changes your system and can run arbitrary code. - The tool preserves a Chrome profile directory and download folder; that can retain cookies, sessions, and downloaded files. If you install, isolate it (use a VM/container) and do not reuse your regular browser profile. - Before installing, request the actual package source (package.json, package lock, and the CLI source). If you cannot review the code or provenance, avoid installing. Also prefer explicit prompts/consent for using remote Browserbase or model API keys rather than automatic selection.

Browser Automation

Automate browser interactions using Stagehand CLI with Claude.

First: Environment Selection (Local vs Remote)

The skill automatically selects between local and remote browser environments:

• If Browserbase API keys exist (BROWSERBASE_API_KEY and BROWSERBASE_PROJECT_ID in .env file): Uses remote Browserbase environment
• If no Browserbase API keys: Falls back to local Chrome browser
• No user prompting: The selection happens automatically based on available configuration

Setup (First Time Only)

Check setup.json in this directory. If setupComplete: false:

npm install    # Install dependencies
npm link       # Create global 'browser' command

Commands

All commands work identically in both modes:

browser navigate <url>                    # Go to URL
browser act "<action>"                    # Natural language action
browser extract "<instruction>" ['{}']    # Extract data (optional schema)
browser observe "<query>"                 # Discover elements
browser screenshot                        # Take screenshot
browser close                             # Close browser

Quick Example

browser navigate https://example.com
browser act "click the Sign In button"
browser extract "get the page title"
browser close

Mode Comparison

Feature	Local	Browserbase
Speed	Faster	Slightly slower
Setup	Chrome required	API key required
Stealth mode	No	Yes
Proxy/CAPTCHA	No	Yes
Best for	Development	Production/scraping

Best Practices

1. Always navigate first before interacting
2. View screenshots after each command to verify
3. Be specific in action descriptions
4. Close browser when done

Troubleshooting

• Chrome not found: Install Chrome or use Browserbase mode
• Action fails: Use browser observe to discover available elements
• Browserbase fails: Verify API key and project ID are set

For detailed examples, see EXAMPLES.md. For API reference, see REFERENCE.md.