Browse 2.0.2

Automate web browser interactions using natural language via CLI commands. Use when the user asks to browse websites, navigate web pages, extract data from w...

Security Scan

The skill's declared purpose (CLI-driven browser automation) matches its install, runtime instructions, and optional credentials; nothing requested is disproportionate, though there are operational and privacy considerations to review before use.

Purpose & Capability

Name/description, required binary 'browse', and the install (npm package @browserbasehq/browse-cli) align with a CLI browser-automation tool. The SKILL.md repeatedly documents local Chrome vs a Browserbase remote service, which is coherent with the stated capability. Minor note: the skill expects a local Chrome/Chromium for local mode but does not declare the browser binary as a required system dependency.

Instruction Scope

Instructions limit the agent to running the browse CLI and describe page navigation, snapshotting, clicking, typing, network capture to disk, and optional remote sessions. They do encourage escalation to a remote Browserbase service for bypassing bot protection and CAPTCHA solving — this is within the skill's browsing/scraping scope but increases privacy/abuse risk (e.g., scraping protected sites). The instructions do not ask the agent to read unrelated files or environment variables beyond the optional Browserbase keys.

Install Mechanism

Install uses an npm package (@browserbasehq/browse-cli) which will create the browse binary — this is a standard, traceable mechanism but carries the usual npm risk surface (post-install scripts, arbitrary code executed at install/run). No downloads from untrusted URLs or archive extracts are present.

Credentials

No required environment variables are declared. The SKILL.md documents two optional env vars (BROWSERBASE_API_KEY, BROWSERBASE_PROJECT_ID) that are directly relevant to enabling remote Browserbase sessions; requiring those keys would be proportionate for remote operation. Be aware that supplying those keys hands browsing activity and session persistence to the third‑party service.

Persistence & Privilege

The skill does not request 'always: true' and is user-invocable. The browse CLI runs a background daemon that persists across commands and (if remote) the Browserbase service offers session persistence — this is expected for a browser tool but means cookies/session state and captured network files may persist until you explicitly stop/clear them.

Assessment

This skill appears to do what it says: it installs a CLI (via npm) and runs browser automation commands. Before installing: (1) verify the npm package name and publisher (@browserbasehq) and review the package repository and maintainers; (2) be cautious installing global npm CLIs (they run code on your machine and may include postinstall scripts); (3) understand that switching to remote Browserbase mode requires giving API keys to a third-party service which will see your browsing activity and may persist sessions/cookies — only provide those keys if you trust the provider and understand its privacy/terms; (4) local mode requires Chrome/Chromium present (ensure that dependency); (5) avoid using remote mode to scrape sites where you lack permission — there are legal and ethical risks; (6) stop the daemon and clear captured network data when finished (use `browse stop` and `browse network clear`).

Browser Automation

Automate browser interactions using the browse CLI with Claude.

Setup check

Before running any browser commands, verify the CLI is available:

which browse || npm install -g @browserbasehq/browse-cli

Environment Selection (Local vs Remote)

The CLI automatically selects between local and remote browser environments based on available configuration:

Local mode (default)

• Uses local Chrome — no API keys needed
• Best for: development, simple pages, trusted sites with no bot protection

Remote mode (Browserbase)

• Activated when BROWSERBASE_API_KEY and BROWSERBASE_PROJECT_ID are set
• Provides: anti-bot stealth, automatic CAPTCHA solving, residential proxies, session persistence
• Use remote mode when: the target site has bot detection, CAPTCHAs, IP rate limiting, Cloudflare protection, or requires geo-specific access
• Get credentials at https://browserbase.com/settings

When to choose which

• Simple browsing (docs, wikis, public APIs): local mode is fine
• Protected sites (login walls, CAPTCHAs, anti-scraping): use remote mode
• If local mode fails with bot detection or access denied: switch to remote mode

Commands

All commands work identically in both modes. The daemon auto-starts on first command.

Navigation

browse open <url>                        # Go to URL (aliases: goto)
browse reload                            # Reload current page
browse back                              # Go back in history
browse forward                           # Go forward in history

Page state (prefer snapshot over screenshot)

browse snapshot                          # Get accessibility tree with element refs (fast, structured)
browse screenshot [path]                 # Take visual screenshot (slow, uses vision tokens)
browse get url                           # Get current URL
browse get title                         # Get page title
browse get text <selector>               # Get text content (use "body" for all text)
browse get html <selector>               # Get HTML content of element
browse get value <selector>              # Get form field value

Use browse snapshot as your default for understanding page state — it returns the accessibility tree with element refs you can use to interact. Only use browse screenshot when you need visual context (layout, images, debugging).

Interaction

browse click <ref>                       # Click element by ref from snapshot (e.g., @0-5)
browse type <text>                       # Type text into focused element
browse fill <selector> <value>           # Fill input and press Enter
browse select <selector> <values...>     # Select dropdown option(s)
browse press <key>                       # Press key (Enter, Tab, Escape, Cmd+A, etc.)
browse drag <fromX> <fromY> <toX> <toY>  # Drag from one point to another
browse scroll <x> <y> <deltaX> <deltaY> # Scroll at coordinates
browse highlight <selector>              # Highlight element on page
browse is visible <selector>             # Check if element is visible
browse is checked <selector>             # Check if element is checked
browse wait <type> [arg]                 # Wait for: load, selector, timeout

Session management

browse stop                              # Stop the browser daemon
browse status                            # Check daemon status (includes env)
browse env                               # Show current environment (local or remote)
browse env local                         # Switch to local Chrome
browse env remote                        # Switch to Browserbase (requires API keys)
browse pages                             # List all open tabs
browse tab_switch <index>                # Switch to tab by index
browse tab_close [index]                 # Close tab

Typical workflow

1. browse open <url> — navigate to the page
2. browse snapshot — read the accessibility tree to understand page structure and get element refs
3. browse click <ref> / browse type <text> / browse fill <selector> <value> — interact using refs from snapshot
4. browse snapshot — confirm the action worked
5. Repeat 3-4 as needed
6. browse stop — close the browser when done

Quick Example

browse open https://example.com
browse snapshot                          # see page structure + element refs
browse click @0-5                        # click element with ref 0-5
browse get title
browse stop

Mode Comparison

Feature	Local	Browserbase
Speed	Faster	Slightly slower
Setup	Chrome required	API key required
Stealth mode	No	Yes (custom Chromium, anti-bot fingerprinting)
CAPTCHA solving	No	Yes (automatic reCAPTCHA/hCaptcha)
Residential proxies	No	Yes (201 countries, geo-targeting)
Session persistence	No	Yes (cookies/auth persist across sessions)
Best for	Development/simple pages	Protected sites, bot detection, production scraping

Best Practices

1. Always browse open first before interacting
2. Use browse snapshot to check page state — it's fast and gives you element refs
3. Only screenshot when visual context is needed (layout checks, images, debugging)
4. Use refs from snapshot to click/interact — e.g., browse click @0-5
5. browse stop when done to clean up the browser session

Troubleshooting

• "No active page": Run browse stop, then check browse status. If it still says running, kill the zombie daemon with pkill -f "browse.*daemon", then retry browse open
• Chrome not found: Install Chrome or use browse env remote
• Action fails: Run browse snapshot to see available elements and their refs
• Browserbase fails: Verify API key and project ID are set

Switching to Remote Mode

Switch to remote when you detect: CAPTCHAs (reCAPTCHA, hCaptcha, Turnstile), bot detection pages ("Checking your browser..."), HTTP 403/429, empty pages on sites that should have content, or the user asks for it.

Don't switch for simple sites (docs, wikis, public APIs, localhost).

browse env remote            # switch to Browserbase
browse env local             # switch back to local Chrome

The switch is sticky until you run browse stop or switch again.

For detailed examples, see EXAMPLES.md. For API reference, see REFERENCE.md.