Browser Automation Skill
Drive Chrome directly over the Chrome DevTools Protocol — navigate, run JS, screenshot, and pick DOM elements — with no MCP server required.
SKILL.md claims all operations run locally with credentials never leaving the machine, and the sole dependency (ws) is locked with integrity hashes; however, the actual scripts (start.js, eval.js, etc.) are absent from the evidence, so least privilege, recovery paths, and the known risk of exposed CDP port 9222 cannot be statically verified, and no confirmation or isolation guidance is given — deducted for unverifiable permissions and recovery.
Docs are self-consistent with pinned dependency versions and a clear happy path; but key script sources are not provided, error handling and failure feedback cannot be checked, and no tests cover this skill itself (repo CI only tests the Go wrapper) — deducted for unreproducible key paths.
Frontmatter trigger conditions are precise (CDP automation, screenshots, DOM picking) with a clear boundary (no MCP needed); but there is no Chinese documentation, and non-fit ranges (e.g., Firefox, headless limitations) are undeclared — deducted for environment fit and boundary gaps.
package./lockfile, repo-level AGPL-3.0 license, and installation docs exist with clear naming; but the skill lacks its own versioning, changelog, known-limitations disclosure, and maintenance ownership, and the hardcoded ~/.claude path is a hidden assumption — deducted for incomplete governance and layering.
The workflow (launch→navigate→eval→screenshot/pick) is sensibly designed with structured JSON output for agent consumption and clear marginal value (no MCP setup); but scripts cannot be execution-verified and no representative output evidence exists — deducted for claimed-but-unproven output usability.
package-lock. provides auditable integrity and origin for ws 8.18.3, which is primary material; but the core scripts are missing from evidence, so key behavioral claims (local-only operation, structured returns) cannot be independently corroborated — deducted for thin primary-material coverage.
- The skill's core scripts (start.js, eval.js, etc.) were not included in the review evidence; this is a static documentation-only review with no execution, so actual behavior is unconfirmed.
- CDP remote debugging on port 9222 allows any local process to control the browser and access logged-in sessions; the --profile mode preserves cookies/auth tokens — use only in trusted environments and mind port exposure.
- Documentation is English-only, and the ws dependency must be installed from npm; users in mainland China should verify npm registry reachability themselves.
- Users are advised to manually review the script sources under skills/browser before installing or running.
What does this skill do, and when should you use it?
browser is one of 11 skills bundled in the stellarlinkco/myclaude repository, living at skills/browser/. It ships a minimal set of Chrome DevTools Protocol (CDP) helper scripts for controlling Chrome locally: launching Chrome with remote debugging, navigating pages, executing JavaScript in the browser context, saving PNG screenshots, and visually picking DOM elements with metadata returned. All scripts connect to Chrome on localhost:9222 and return structured JSON for agent consumption. Everything runs locally, so credentials never leave the machine.
The skill provides five scripts: start.js launches Chrome with remote debugging on port 9222 (--profile keeps cookies/auth); nav.js navigates the current or a new tab to a URL; eval.js executes a JavaScript expression or IIFE in the page; screenshot.js captures the page and returns the path and filename of the saved PNG; pick.js lets you click an element in response to a prompt and returns its tag, id, classes, text, href, selector, and rect. Scripts communicate with Chrome over CDP WebSockets (requiring the ws package) and output structured JSON.
What are this skill's strengths and limitations?
- Zero MCP dependency — plain Node.js scripts over CDP, extremely lightweight to deploy
- Fully local execution; credentials and cookies never leave the machine
- --profile flag preserves cookies and auth tokens for authenticated pages
- Structured JSON output that agents can parse directly
- Chrome-only (CDP); no documented support for Firefox, Safari, or other browsers
- Requires manually installing the ws npm package before first use
- Hard-wired to localhost:9222 — no remote browser support
- No test suite or per-skill changelog documented; multi-session or concurrent-browser scenarios are not covered
How do you install this skill?
Install via the repo's installer: npx github:stellarlinkco/myclaude (use --list to see installable items and pick the browser skill individually). The skill lands in ~/.claude/skills/browser/. Before first use, install the dependency: npm install --prefix ~/.claude/skills/browser/browser ws. Chrome must be installed locally.
How do you use this skill?
Typical workflow: (1) scripts/start.js --profile to launch Chrome (add --profile to preserve authenticated sessions); (2) scripts/nav.js https://example.com to navigate (--new opens a new tab); (3) scripts/eval.js 'document.title' to inspect; (4) scripts/screenshot.js to capture, or scripts/pick.js "Click the submit button" to select an element. All scripts connect to localhost:9222 and return structured JSON for the agent to process.