PW Browser Setup

浏览器自动化环境的一键安装、检查和验证工具。 安装 Playwright + Chromium，支持非头模式（模拟真实用户浏览器）和头模式。 包含系统兼容性检查（内存、CPU、磁盘）、依赖安装、Xvfb 虚拟显示器配置。 当用户要求：(1) 安装浏览器自动化环境 (2) 配置 Playwright (3) 检查系...

Security Scan

The skill's files and runtime instructions are consistent with its stated purpose (installing and verifying a Playwright + Chromium environment); it performs expected system checks, package installs, and a browser verification step and does not contain hidden exfiltration or unrelated actions.

Purpose & Capability

Name/description match the included scripts: check system requirements, install Xvfb and Playwright/Chromium, and verify by opening a page and taking a screenshot. All required actions and resources in the scripts are coherent with browser setup.

Instruction Scope

Runtime instructions and scripts perform expected checks and operations (read /proc/meminfo, df, sysctl, install packages, run npm/npx and a Node/Playwright verification that visits https://www.baidu.com). SKILL.md includes an optional Feishu (open.feishu.cn) example that references a TENANT_TOKEN environment variable — the scripts do not themselves require or read that variable, but the example shows how a user could upload the screenshot to an external service. Be aware the verification step performs outgoing network requests (to download browsers and to visit baidu.com).

Install Mechanism

No formal install spec (instruction-only) but bundled scripts call npm/npx which will download Playwright and binaries (~hundreds of MB) from Playwright mirrors via the npm ecosystem. This is expected for this purpose but carries standard supply-chain and bandwidth implications (npm downloads, playwright browser artifacts). No arbitrary URL downloads or shorteners are used.

Credentials

The skill declares no required credentials and does not access unexpected env vars. The SKILL.md example shows using a TENANT_TOKEN for Feishu uploads but this is optional and not declared as required — if you supply such a token to send screenshots, that token would be sent to Feishu as shown. The scripts may also attempt to run package managers with sudo (non-interactive sudo -n) and will fall back to asking the user to run commands manually if sudo is unavailable.

Persistence & Privilege

always is false; the skill only creates/supports local helper scripts in its own scripts directory (start-xvfb.sh) and writes caches to the user's standard Playwright cache under $HOME/.cache. It does not modify other skills or system-wide agent settings.

Assessment

This skill is coherent for setting up Playwright + Chromium. Before running it: (1) review and be comfortable with npm installing packages (it may install globally and download ~300MB of browser artifacts); (2) expect some steps require sudo to install system libs/Xvfb—the scripts try non-interactive sudo and will ask you to run commands manually if unavailable; (3) verification opens an external site (baidu.com) and performs outgoing downloads—run in an environment with network access you trust; (4) the SKILL.md shows an optional Feishu upload that would use a TENANT_TOKEN you provide—do not supply sensitive tokens unless you trust the destination; (5) if you need stricter isolation, run the install/verify scripts inside a disposable VM or container and inspect commands before granting sudo.

Browser Setup

一键安装和验证 Playwright + Chromium 浏览器自动化环境。

快速流程

按顺序执行以下三步：

Step 1: 检查系统兼容性

bash scripts/check-compat.sh

检查项：操作系统、内存（≥2GB，推荐 4GB+）、CPU（≥2核）、磁盘（≥1GB）、Node.js（≥18）、Xvfb 状态。

如果 FAIL > 0，先解决问题再继续。

Step 2: 安装浏览器环境

bash scripts/install-browser.sh <工作目录路径>

自动完成：

• 安装 Xvfb 虚拟显示器（Linux）+ Chrome 系统依赖
• 安装 Playwright npm 包（全局 + 项目内）
• 下载 Chromium + Chrome Headless Shell
• 创建 scripts/start-xvfb.sh 辅助脚本

Step 3: 验证

# 头模式（适合服务器）
bash scripts/verify-browser.sh <工作目录> /tmp/browser-verify.png headless

# 非头模式（模拟真实用户，需先启动 Xvfb）
bash scripts/verify-browser.sh <工作目录> /tmp/browser-verify.png headed

验证脚本会：打开百度 → 截取屏幕 → 输出标题和热搜第一 → 返回截图路径。

非头模式说明

服务器环境没有物理显示器，需要 Xvfb 创建虚拟显示器：

export DISPLAY=:99
Xvfb :99 -screen 0 1280x900x24 -ac &

之后 Playwright 设置 headless: false，浏览器在虚拟显示器中运行，行为与真实用户完全一致（加载所有扩展、渲染 WebGL、触发真实 DOM 事件）。

Playwright 代码示例

const { chromium } = require('playwright');

const browser = await chromium.launch({
  headless: false,          // 非头模式
  args: ['--no-sandbox']    // 服务器环境必需
});
const page = await browser.newPage();
await page.goto('https://www.baidu.com');
await page.screenshot({ path: '/tmp/screenshot.png' });
await browser.close();

截图发送到飞书

验证脚本生成截图后，可通过飞书 API 上传并发送：

# 1. 上传图片获取 image_key
IMAGE_KEY=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/images" \
  -H "Authorization: Bearer $TENANT_TOKEN" \
  -F "image_type=message" \
  -F "image=@/tmp/browser-verify.png" | python3 -c "import sys,json; print(json.load(sys.stdin)['data']['image_key'])")

# 2. 发送图片消息
curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id" \
  -H "Authorization: Bearer $TENANT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"receive_id":"<open_id>","msg_type":"image","content":"{\"image_key\":\"'"$IMAGE_KEY"'\"}"}'