Browser Automation Zero Token

Build and run low-code browser automation workflows with agent-browser CLI and reusable skills, especially for repetitive web tasks like 登录、签到、表单填写、固定点击流程、状态...

Security Scan

The skill is internally consistent: it documents using the agent-browser CLI to build repeatable browser workflows, asks for the expected binaries, and has no unexplained requirements or hidden install endpoints.

Purpose & Capability

Name/description match the instructions. Required binaries (agent-browser, npm) and the npm install of the agent-browser package are appropriate for a CLI-based browser automation skill.

Instruction Scope

Instructions stay on-topic (open, snapshot, interact, verify, save/load state). One notable operational instruction is saving/loading auth state (agent-browser state save/load auth.json), which is expected for persistent sessions but can store sensitive session tokens—users should be warned and manage those files carefully.

Install Mechanism

Install uses npm to install the agent-browser package and produces the agent-browser binary, which is a coherent choice. Installing from npm is normal but carries the usual supply-chain risk if the package or publisher is unknown; no arbitrary download URLs or extracts are used.

Credentials

The skill declares no environment variables or credentials. The SKILL.md does reference having credentials available for target sites (logins) and saving session state, which is proportionate to the described purpose and not excessive.

Persistence & Privilege

always:false (default) and normal autonomous invocation are used. The skill does not request persistent system-wide privileges or modify other skills' configs.

Assessment

This skill appears to do what it says, but take these precautions before installing/using it: 1) Verify the agent-browser npm package and publisher are legitimate (check the npm registry page, maintainers, and recent release notes) before running npm install -g. 2) Be careful with saved state files (e.g., auth.json): they may contain session cookies or tokens—store them securely, avoid committing them to repos, and delete them when not needed. 3) Run automation in a constrained environment (container or dedicated machine) if the workflows interact with sensitive accounts. 4) Ensure automating the target site doesn't violate its terms of service and that you have authorization for the accounts you automate. 5) If you need higher assurance, inspect the installed agent-browser package code or run it in an isolated sandbox first.

Use agent-browser plus OpenClaw skills to turn repeatable browser tasks into reusable, low-maintenance workflows.

When To Use

Use this skill for repeatable browser workflows such as:

• daily site sign-in
• repeated login + click flows
• dashboard checks
• fixed form-filling routines
• internal admin flows

Prefer this pattern when Playwright/Puppeteer feels too heavy, selectors are brittle, or repeated screenshot/tool loops waste tokens.

Core Workflow

Always think in this loop:

1. OPEN — open the target page
2. SNAPSHOT — inspect page structure and collect current @refs
3. INTERACT — click / fill / select using @refs
4. VERIFY — re-snapshot or check page state after each meaningful change
5. REPEAT — continue until the business task is done
6. CLOSE — close the browser session cleanly

Short form:

OPEN → SNAPSHOT → INTERACT → VERIFY → REPEAT → CLOSE

Preconditions

Before using this skill, verify:

• agent-browser is installed
• browser runtime/dependencies are installed
• the target site allows normal browser interaction
• credentials are available if login is required
• the user is authorized to automate the target site

Install CLI:

npm install -g agent-browser
agent-browser install --with-deps
agent-browser --version

Optional ecosystem install:

clawhub install openclaw-skills-browserautomation-skill

Base Command Set

Use this minimal loop:

agent-browser open <url>
agent-browser snapshot -i
agent-browser click @e<n>
agent-browser fill @e<n> "text"
agent-browser state save auth.json
agent-browser state load auth.json
agent-browser close

Important rule: @refs come from the latest snapshot. After navigation or major DOM changes, snapshot again. More command notes live in references/source-notes.md.

Operating Rules

1. Snapshot before interacting

Do not guess refs. Always obtain fresh @refs from agent-browser snapshot -i before click/fill/select actions.

2. Re-snapshot after state changes

After login, route changes, modal opens, tab switches, or dynamic content loads, run snapshot again.

3. Prefer refs over brittle selectors

Use @e<n> from snapshots whenever possible. Fall back to complex selectors only when refs or semantic locators are insufficient.

4. Save auth state for recurring tasks

If the workflow requires login and will be reused:

agent-browser state save auth.json
agent-browser state load auth.json

This is often the difference between “semi-automated” and “truly one-command repeatable.”

5. Verify, don’t assume

After key actions, confirm progress using one or more of:

• another snapshot
• agent-browser get url
• agent-browser get title
• visible text checks
• screenshots for debugging

Zero-Token Execution Pattern

Use zero-token mode when the workflow is already known and stable:

1. discover the workflow once
2. capture the working CLI sequence
3. store it in a skill or task markdown
4. rerun it directly without repeated AI reasoning

Example:

agent-browser open https://example.com/login
agent-browser snapshot -i
agent-browser fill @e3 "username"
agent-browser fill @e4 "password"
agent-browser click @e5
agent-browser snapshot -i
agent-browser click @e21
agent-browser close

Build A Reusable Site Skill

When the user wants to turn one website flow into a reusable skill:

1. identify the business goal
2. map the page flow once
3. note where refs must be refreshed
4. decide whether auth state should be saved/loaded
5. write the repeatable steps into a concise skill
6. document failure points and re-snapshot requirements

A good site skill should capture:

• target site / task
• prerequisites
• ordered browser steps
• verification points
• state save/load strategy
• caveats about changing refs

Example: Daily Sign-In Flow

---
name: auto-signin-example
description: Automatically sign in to example.com using agent-browser CLI.
---

# Auto Sign-In Example

## Workflow
1. Open the login page.
2. Snapshot interactive elements.
3. Fill username and password using current refs.
4. Click the login button.
5. Re-snapshot after navigation.
6. Click the sign-in button.
7. Save state if reuse is needed.
8. Close the browser.

Debugging

If the automation breaks, check in this order:

1. was a fresh snapshot taken?
2. did the page navigate or re-render?
3. did login fail silently?
4. did the saved state expire?
5. did a ref change?
6. does the flow need an explicit wait?

For command examples, see references/source-notes.md.

When Not To Use This Pattern

Avoid overcommitting to zero-token browser automation when:

• the task requires heavy judgment each run
• the page changes unpredictably every time
• anti-bot controls block normal automation
• the target workflow includes sensitive steps that should not be automated without explicit approval
• direct API integration would be cleaner and more reliable

References

If you need the distilled source rationale, read references/source-notes.md.

Output Expectations

Depending on the request, this skill should help produce one of:

• a repeatable CLI command sequence
• a site-specific automation skill
• a debugging checklist for a broken browser flow
• a saved-state based recurring automation routine

Common Failure Modes

Avoid these:

• using stale refs after navigation
• storing hardcoded assumptions without verification steps
• skipping auth-state management for recurring tasks
• claiming zero-token while still relying on repeated AI interpretation each run

Fast Heuristic

If the workflow can be discovered once, re-run many times, and verified through snapshots/state checks, it is a strong candidate for this skill.