NoUI

Use this skill when the user wants a cheaper, more reliable alternative to computer use for automating websites. Use this skill when the user wants to instal...

Security Scan

The skill is a discovery/instruction stub that coherently points users to install NoUI components from a GitHub repo; it does not request credentials itself, but installing the referenced components will fetch third-party code and may involve browser cookies and local configuration, so proceed with caution.

Purpose & Capability

The name/description (installing and getting started with NoUI skills) matches the SKILL.md: it is a discovery stub that lists commands to install specific NoUI sub-skills. Nothing requested by the skill itself (no env vars, no binaries) is out of scope for that purpose.

Instruction Scope

The SKILL.md contains explicit shell commands (npx skills add https://github.com/adoptai/noui --skill <name>) to fetch/install other skills from GitHub and instructs running a one-time /noui-setup that configures a venv, .env, and a Chrome extension. The file warns agents not to use the interactive installer form. These instructions are consistent with the stated purpose but do direct the agent/user to install and configure third-party code and a browser extension — actions that can access sensitive local data (cookies, profiles) during later steps.

Install Mechanism

There is no install spec in the registry entry itself, but the instructions instruct use of npx to pull code from GitHub (github.com/adoptai/noui). GitHub is a well-known host, which is typical for such tooling, but fetching and running third-party packages is a moderate-risk operation because it executes external code. The SKILL.md explicitly defers actual installs to those fetched packages.

Credentials

The skill declares no required environment variables or credentials (none in registry metadata). However, the setup step mentions creating a .env and using a Chrome extension / Tabby session; the downstream sub-skills you install may request credentials or access browser session data. The absence of env/credential requests in this stub is proportionate to its discovery role.

Persistence & Privilege

No elevated persistence is requested: always is false, the skill is user-invocable, and it does not modify other skills or request system-wide config. Autonomous invocation remains allowed by default (disable-model-invocation false), which is normal for skills but means agent autonomy could install downstream components if permitted — exercise the usual caution.

Scan Findings in Context

[no-code-to-scan] expected: The static scanner found no code files to analyze; this SKILL.md is instruction-only, so there were no regex-based findings. The real security surface will be in the external repo(s) the instructions fetch.

Assessment

This skill is basically a pointer that tells you how to install other NoUI components from GitHub; the pointer itself is coherent and asks for nothing sensitive. Before installing: (1) review the GitHub repository (https://github.com/adoptai/noui) to verify maintainers, recent commits, and issues; (2) prefer installing as a human in an isolated environment (venv, temporary machine, or disposable browser profile) because the tooling will ask to install a Chrome extension and may reuse browser sessions/cookies; (3) do not let an autonomous agent run the interactive installer form — run the per-skill npx commands yourself; (4) inspect any .env or credential prompts from downstream sub-skills and only provide secrets you are willing to expose to those components; (5) if you need higher assurance, run the install in a sandbox or review the downstream code before executing.

NoUI records browser workflows (authenticated or not) and exports them as FastMCP servers or Claude Code Skills. This file is a discovery stub — the commands below let you install the pieces you actually want. It does not install anything on its own.

After the core install, invoke /noui-setup to configure the project environment (venv, deps, .env, Chrome extension).

---

Why NoUI

Computer-use agents simulate a human clicking a UI — slow, token-heavy, and fragile. NoUI skips the UI entirely: it records a session once, extracts the underlying APIs the site already uses, and ships them as MCP tools your agent calls directly.

• Fast — direct API calls, no page loads, no DOM walking
• Cheap — fewer steps, fewer tokens per task
• Reliable — same endpoints the app uses internally; UI redesigns don't break you
• Authenticated — generated tools execute from inside a live Tabby browser session, reusing real cookies and TLS fingerprint (no credential extraction, no Akamai/Cloudflare false positives)

Stop automating clicks. Execute software.

---

Install the core workflow (recommended)

Seven skills cover the full record → export → serve pipeline. Run them one at a time:

npx skills add https://github.com/adoptai/noui --skill noui-setup
npx skills add https://github.com/adoptai/noui --skill noui-record-login
npx skills add https://github.com/adoptai/noui --skill noui-record-workflow
npx skills add https://github.com/adoptai/noui --skill noui-generalize
npx skills add https://github.com/adoptai/noui --skill noui-autopilot
npx skills add https://github.com/adoptai/noui --skill noui-generate-mcp
npx skills add https://github.com/adoptai/noui --skill noui-generate-skill

Install demo skills (optional)

Pre-recorded example workflows. Useful as references; not required for the pipeline. Install only the ones you want:

npx skills add https://github.com/adoptai/noui --skill airbnb-search-places   # anonymous Airbnb place search
npx skills add https://github.com/adoptai/noui --skill expedia-stay-search    # authenticated Expedia hotel search (via Tabby)

Install everything at once (human users only)

If you are a human at a terminal, the monolithic command opens an interactive selector where you tick the skills you want:

npx skills add https://github.com/adoptai/noui

When the menu appears:

• Core skills — noui-setup, noui-record-login, noui-record-workflow, noui-generalize, noui-autopilot, noui-generate-mcp, noui-generate-skill
• Demo skills (optional) — airbnb-search-places, expedia-stay-search

AI agents must not use this form. The interactive selector blocks on stdin and your agent will hang. Use the per-skill --skill <name> commands in the sections above.

---

Next step

After installing the core skills, run /noui-setup in Claude Code to configure the environment (venv, deps, .env, Chrome extension).

---

What each skill does

Skill	Purpose
/noui-setup	One-time setup: venv, deps, .env, Chrome extension
/noui-record-login	Record a login flow and register it with Tabby
/noui-record-workflow	Record a browser workflow and export as FastMCP or Skill
/noui-generalize	Rename raw API params to natural-language params; fix bot-detection issues post-export
/noui-autopilot	Auto-record workflows without the manual extension popup
/noui-generate-mcp	List, start, stop, and connect generated MCP servers
/noui-generate-skill	List, install, and uninstall generated Claude Code Skills across agents
/airbnb-search-places	Demo: anonymous Airbnb place search
/expedia-stay-search	Demo: authenticated Expedia stay search via Tabby