Browser Orchestration

VerifiedCaution

Uses browser-use via Chrome DevTools Protocol to browse the web. Remotely orchestrate a browser to accomplish web tasks.

Sby Skills Guide Bot
DevelopmentIntermediate
7/22/2026
Claude CodeCursorWindsurfCopilotCodex
#browser-automation#web-scraping#cli#chrome-devtools-protocol#sso-auth

Recommended for

Automated summary

Provides a CLI that orchestrates a remote Chromium browser (through browser-use and the Chrome DevTools Protocol) to navigate, fill forms, run JavaScript, and capture traffic.

Strengths

  • Complete scriptable CLI surface: navigate, fill, click, click-at, dom, execute, cookies.
  • Authenticated XHR runs inside the page's origin, carrying cookies and bypassing CORS.
  • Captures HTTP and WebSocket traffic to NDJSON and reads HttpOnly cookies over CDP.
  • Generic SSO login helper (--match globs, --success-url) that can extract cookies, localStorage, and evaluated values.

Limitations

  • You must start, monitor, and stop a background server before any client command works.
  • Relies on CSS selectors, which are brittle, and offers no built-in assertions or visual checks.
  • Documentation is thin, deferring most detail to the project README.
When to use it

Use it when an agent must drive a real web app: log in, scrape data, replay authenticated requests, or observe network traffic.

When not to use it

Avoid it for large-scale crawling or when a plain HTTP/curl call would do, since browser orchestration is heavier and slower.

Security analysis

Caution
Quality score78/100

The skill is a genuine browser-automation CLI wrapping browser-use/CDP, but it grants the agent powerful primitives: arbitrary in-page JS execution, HttpOnly cookie reading, credentialed cross-origin-bypassing XHR, full HTTP/WebSocket capture, and SSO session-cookie extraction to disk. These are all documented and purposeful rather than covert, and there is no destructive or obfuscated payload, so it lands at caution rather than risky — but agents using it can trivially surface session tokens or credentials in output/logs.

Findings
  • •Executes arbitrary JavaScript in the page context (`browser client execute`), which can read/modify any authenticated page state
  • •Reads cookies including HttpOnly cookies via CDP (`browser client cookies`), a credential-harvesting primitive
  • •Performs authenticated XHR from the page origin, explicitly bypassing CORS with the user's session cookies
  • •SSO login flow captures session cookies/localStorage/eval results and can write them to a file (`--out ./.cookies.json`), enabling session token extraction
  • •Records full HTTP and WebSocket traffic to NDJSON via CDP capture, which may include secrets or tokens
  • •Runs a long-lived background browser server and requires shell/CLI execution, though no allowed-tools are declared
  • •No obfuscation, no curl|sh install, no destructive filesystem commands observed; capabilities are legitimate for browser automation but high-impact if misused
How this analysis is made

Examples

Search and summarize results
Start the browser server, navigate to google.com, type 'hamster dance' into the search box, click search, read the first 3 results with execute, summarize them, then stop the server.
Authenticated API call from the page
Navigate to https://app.example.com/dashboard, then run browser client xhr https://app.example.com/api/me -H 'Accept: application/json' and show me the JSON response.
SSO capture
Use browser login --url https://app.example.com --match '*app.example.com/dashboard*' --cookie session --out cookies.json to log in via SSO and save the session cookie.

name: browser description: remotely orchestrate a (chromium) browser to utilize web apps

Browser

Uses browser-use (via Chrome DevTools Protocol) to browse any website. Remotely orchestrate a browser, to navigate the web. Meaning any task that can be accomplished via a browser.

Instructions

  • read README.md to understand this project

QUICK REFERENCE

These are CLI commands you may use.

| Task | Command | Purpose | |------|---------|---------| | Start Browser Server | browser server start | Start background browser server | | Stop Browser Server | browser server stop | Stop background server | | Server Status | browser server status | Check server status and latest logs summary | | View Live Logs | browser server logs --follow | Tail live server logs | | Get Page Status | browser client status | Get current page URL and title | | Navigate to URL | browser client navigate URL | Navigate browser to specified URL | | Execute JavaScript | browser client execute JAVASCRIPT | Execute JavaScript code (arrow function) | | Get DOM Content | browser client dom [SELECTOR] | Get HTML content of element (default: body) | | Fill Input Field | browser client fill SELECTOR VALUE | Fill form input field with value | | Click Element | browser client click SELECTOR | Click on specified element | | Click at Coordinates | browser client click-at X Y | Click at specific coordinates | | Get Cookies | browser client cookies [--domain D] [--name N] | Read cookies incl. HttpOnly (CDP) | | Authed XHR | browser client xhr URL [-X METHOD] [-H 'K: V'] [-d BODY] [--body] | Run a request inside the page's origin (carries cookies, bypasses CORS) | | SSO Login + Capture | browser login --url URL --match '*host/path*' [--cookie NAME] [--local KEY] [--eval NAME=JS] [--out FILE] | Headed SSO login; capture cookies / localStorage / eval values. No SSO provider is hardcoded — you pass --match globs (or --success-url regex). | | Start Capture | browser capture start [FILE] [--filter SUBSTR] | Record HTTP + WebSocket traffic to NDJSON | | Stop Capture | browser capture stop | Stop the active capture | | Verify/Repair CLI | browser-agent doctor | Ensure the browser command is THIS CLI (repairs browser-use shadowing) |

Examples

Sample user prompt:

let's test this project:

  • start browser service
  • use client scripts to
    • navigate to google.com
    • type hamster dance into search box
    • click search button
    • read first 3 search results
    • summarize them in your response to me
    • stop the server

Sample agent output (ie. Gemini 3 Flash):

GitHub Copilot: Created 6 todos

Starting: *Start browser service* (1/6)

Ran terminal command: browser server start

Stdout:
Starting browser server...
✅ Server started in background (PID 12345)
Logs: /home/user/.browser_agent/server.log

Starting: *Navigate to Google* (2/6)

Ran terminal command: browser client navigate "https://www.google.com"

Stdout:
✅ Navigated to https://www.google.com

Starting: *Type search query* (3/6)

Ran terminal command: browser client fill "[name='q']" "hamster dance"

Stdout:
✅ Filled [name='q']

Starting: *Click search button* (4/6)

Ran terminal command: browser client click "[name='btnK']"

Stdout:
✅ Clicked [name='btnK']

Starting: *Read search results* (5/6)

Ran terminal command: browser client execute "() => Array.from(document.querySelectorAll('#search h3')).slice(0, 3).map(h3 => ({title: h3.innerText, link: h3.closest('a')?.href}))"

Stdout:
Result: [{"title": "Hampton the Hamster \"The Hamsterdance Song\"", "link": "https://www.youtube.com/watch?v=1qN72LEQnaU"}, ...]

Starting: *Stop server* (6/6)

Ran terminal command: browser server stop

Stdout:
✅ Server stopped (PID 12345)

Completed: *Summarize results*

The browser service was successfully started, and I performed the requested search for "hamster dance" on Google. Here are the first three search results:

1.  **Hampton the Hamster "The Hamsterdance Song"**
    - [https://www.youtube.com/watch?v=1qN72LEQnaU](https://www.youtube.com/watch?v=1qN72LEQnaU)
2.  **Hampton the Hamster - The Hamsterdance Song (Official Video ...**
    - [https://www.youtube.com/watch?v=6WpMlwVwydo](https://www.youtube.com/watch?v=6WpMlwVwydo)
3.  **Hamster Dance - Wikipedia**
    - [https://en.wikipedia.org/wiki/Hamster_Dance](https://en.wikipedia.org/wiki/Hamster_Dance)

SSO Login + Cookie Capture Example

Open a headed browser, let the user complete SSO (e.g. Okta), and capture the session cookie(s) once the page settles. Reusable by any tool that needs a cookie-authenticated session.

# Capture the Slack 'd' cookie after login, writing JSON to a file
browser login \
  --url https://app.slack.com/client \
  --cookie d \
  --cookie-domain slack.com \
  --success-url "/client" \
  --out ./.cookies.json
# Detection is staged: URL must match --success-url (or destination host),
# the page must finish loading, and all required --cookie names must be present
# before capture. Without --out, the cookie map prints to stdout.

Authenticated XHR Example

Run an HTTP request from inside the current page's origin — it carries existing cookies and bypasses CORS. Useful for hitting same-site JSON endpoints.

browser client navigate "https://app.example.com"
browser client xhr "https://app.example.com/api/me" --body
# --body prints only the response body; omit it to see status + headers + body
browser client xhr "https://app.example.com/api/items" -X POST \
  -H 'Content-Type: application/json' -d '{"q":"x"}'

Traffic Capture Example

Record HTTP requests/responses and WebSocket frames (via CDP) to NDJSON for reverse-engineering an API.

browser capture start --filter example.com      # only record matching URLs
browser client navigate "https://example.com"   # interact / click around
browser capture stop                             # flush + close the file
# Output: captures/<timestamp>.ndjson, one JSON record per request/response/ws frame

From the file to a first result

The download contains exactly the content displayed on this page. This copy may differ from the latest version in the source repository.

View the source and supporting files

This download contains SKILL.md only. Any scripts, references, templates and dependencies are not included. Get the required files from the source, preserving their directory structure, before continuing.

1. Download the file

Download SKILL.md

From the root of a test project, save the file as .skill-downloads/browser-orchestration-mrwakc2w/SKILL.md, or use the command below. This folder is for inspecting the skill before installation.

Command for macOS/Linux or WSL: requires a POSIX shell and curl. On Windows without WSL, use the download button and create the folder manually.

mkdir -p '.skill-downloads/browser-orchestration-mrwakc2w' && curl --fail --show-error --location 'https://skills-guides.com/api/skills/browser-orchestration-mrwakc2w/download' --output '.skill-downloads/browser-orchestration-mrwakc2w/SKILL.md.part' && mv '.skill-downloads/browser-orchestration-mrwakc2w/SKILL.md.part' '.skill-downloads/browser-orchestration-mrwakc2w/SKILL.md'

2. Check prerequisites

Read SKILL.md before using it. If it references scripts or external services, inspect them and prepare the required access in your test environment.

Original excerpt: QUICK REFERENCE

These are CLI commands you may use.

TaskCommandPurpose
Start Browser Serverbrowser server startStart background browser server
Stop Browser Serverbrowser server stopStop background server
Server Statusbrowser server statusCheck server status and latest logs summary
View Live Logsbrowser server logs --followTail live server logs
Get Page Statusbrowser client statusGet current page URL and title
Navigate to URLbrowser client navigate URLNavigate browser to specified URL
Execute JavaScriptbrowser client execute JAVASCRIPTExecute JavaScript code (arrow function)
Get DOM Contentbrowser client dom [SELECTOR]Get HTML content of element (default: body)
Fill Input Fieldbrowser client fill SELECTOR VALUEFill form input field with value
Click Elementbrowser client click SELECTORClick on specified element
Click at Coordinatesbrowser client click-at X YClick at specific coordinates
Get Cookiesbrowser client cookies [--domain D] [--name N]Read cookies incl. HttpOnly (CDP)
Authed XHRbrowser client xhr URL [-X METHOD] [-H 'K: V'] [-d BODY] [--body]Run a request inside the page's origin (carries cookies, bypasses CORS)
SSO Login + Capturebrowser login --url URL --match '*host/path*' [--cookie NAME] [--local KEY] [--eval NAME=JS] [--out FILE]Headed SSO login; capture cookies / localStorage / eval values. No SSO provider is hardcoded — you pass --match globs (or --success-url regex).
Start Capturebrowser capture start [FILE] [--filter SUBSTR]Record HTTP + WebSocket traffic to NDJSON
Stop Capturebrowser capture stopStop the active capture
Verify/Repair CLIbrowser-agent doctorEnsure the browser command is THIS CLI (repairs browser-use shadowing)

The platforms on this page are catalog indications. The paths below follow tool documentation; they do not prove this skill has been run in those tools. No minimum tool version is confirmed for this listing.

3. Load the skill

After inspection, copy the complete folder into your project using one of the commands below, then open a new tool session. The command stops if a folder with the same name already exists: compare the files before replacing it.

Claude Code
test -f '.skill-downloads/browser-orchestration-mrwakc2w/SKILL.md' && test -s '.skill-downloads/browser-orchestration-mrwakc2w/SKILL.md' && mkdir -p '.claude/skills' && test ! -e '.claude/skills/browser' && cp -R '.skill-downloads/browser-orchestration-mrwakc2w' '.claude/skills/browser'

Cursor
test -f '.skill-downloads/browser-orchestration-mrwakc2w/SKILL.md' && test -s '.skill-downloads/browser-orchestration-mrwakc2w/SKILL.md' && mkdir -p '.cursor/skills' && test ! -e '.cursor/skills/browser' && cp -R '.skill-downloads/browser-orchestration-mrwakc2w' '.cursor/skills/browser'

Codex
test -f '.skill-downloads/browser-orchestration-mrwakc2w/SKILL.md' && test -s '.skill-downloads/browser-orchestration-mrwakc2w/SKILL.md' && mkdir -p '.agents/skills' && test ! -e '.agents/skills/browser' && cp -R '.skill-downloads/browser-orchestration-mrwakc2w' '.agents/skills/browser'

OpenSkills

OpenSkills must already be installed. The local install/read procedure is checked with OpenSkills 1.5.0, which requires Node.js ≥ 20.6.0. Catalog slugs are not resolved automatically.

Official OpenSkills installation
openskills install './.skill-downloads/browser-orchestration-mrwakc2w'

openskills read 'browser-orchestration-mrwakc2w'

Reading should display the installed file content and its base directory. It does not run the skill or install its dependencies.

For an agent that reads AGENTS.md, then sync the index. This command changes AGENTS.md: review the diff before using it.

openskills sync

Manual method or another tool: attach SKILL.md to a conversation, or open it in an agent that can read files. Include any required supporting resources. No universal folder is recognized by every tool.

4. Try a first task

Use a short, synthetic input: an API endpoint, a small document or an interface brief. In a new conversation, attach the file or give the agent its path, then adapt this request:

Read .skill-downloads/browser-orchestration-mrwakc2w/SKILL.md and apply its instructions to this example: [describe a test input]. Identify any missing files, dependencies or access. Produce the result requested by the skill without inventing data or running unreviewed scripts.

Expected result: output matching the skill instructions, or a precise list of missing prerequisites. A read confirmation alone does not validate a first use. If an external resource is unavailable, that path remains untested.

Related skills