Skip to content
Back to skills

Browser Use

ASecurity

Chrome DevTools MCP automation: existing Chrome tabs, no AppleScript.

  • 2 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added November 7, 2026
toolsbashdebugging

Works with

  • cli
  • mcp

Security analysis

A100/100

Pro scans all 4 files and shows the line behind each finding

Scanned November 7, 2026

npx -y skills add BumpyClock/agent-templates --skill browser-use --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Browser Use?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Browser Use
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/bumpyclock-browser-use/badge)](https://www.skillsdirectory.com/skills/bumpyclock-browser-use)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: browser-use
description: "Chrome DevTools MCP automation: existing Chrome tabs, no AppleScript."
---

# Browser Use

Browser tasks against existing Chrome session. Config repair: `mcporter-config.md`.

Hard rule: reattach existing Chrome profile only.

```bash
mcporter call chrome-devtools.<tool>
```

Login-heavy sites fail in isolated profiles (captcha, device checks, missing SSO/extension). Prefer existing Chrome for any site needing login.

Never use `chrome-isolated`, Playwright, Puppeteer, Codex in-app browser, AppleScript, `osascript`, GUI scripting, or macOS `open` for browser control unless user explicitly asks for isolated/new browser.

Screenshot/live UI bugs require existing-Chrome path. `curl`, source inspection, Worker tests, local Playwright = supporting proof only; not equivalent when user showed rendered browser problem or page depends on login/profile state.

## Check MCP

```bash
mcporter list chrome-devtools --schema
mcporter call chrome-devtools.list_pages --args '{}' --output text
```

`list_pages` must show user's real open tabs. Blank/default isolated Chrome → reattach failed, stop and say so.

Attach prompt recovery: if Chrome shows "Allow remote debugging?", click Allow via Peekaboo, rerun `list_pages`.

```bash
PB="${PEEKABOO_BIN:-$HOME/bin/peekaboo}"
[ -x "$PB" ] || PB="$(command -v peekaboo)"
"$PB" permissions status --json
"$PB" see --app frontmost --path /tmp/chrome-attach.png --json --annotate
# Click visible Allow button using current snapshot coords
"$PB" click --coords <allow_x>,<allow_y> --json
mcporter call chrome-devtools.list_pages --args '{}' --output text
```

Attach-alert rule: snapshot shows Chrome DevTools/MCP attach prompt → click visible Allow once, rerun `list_pages`. Button not visible or prompt ambiguous → stop, ask. Never silently switch to Playwright/Puppeteer.

`DevToolsActivePort` error → ask user to restart Chrome or DevTools bridge, retry once:

```bash
mcporter daemon restart
mcporter call chrome-devtools.list_pages --args '{}' --output text
```

Still fails → stop, say Chrome DevTools MCP unavailable. No AppleScript.

Avoid noisy recovery loops. Repeated restarts trigger reconnect/login prompts. Try once, then pause.

## Typical Flow

```bash
mcporter call chrome-devtools.select_page --args '{"pageId":9}' --output text
mcporter call chrome-devtools.take_snapshot --args '{}' --output text
mcporter call chrome-devtools.navigate_page --args '{"url":"https://example.com"}' --output text
mcporter call chrome-devtools.click --args '{"uid":"1_38","includeSnapshot":true}' --output text
mcporter call chrome-devtools.fill --args '{"uid":"1_13","value":"text","includeSnapshot":true}' --output text
mcporter call chrome-devtools.evaluate_script --args '{"function":"() => document.title"}' --output json
```

Use `take_snapshot` before actions, current `uid` values only. `take_screenshot` only when visual layout matters.

## Live UI Proof

```bash
mcporter call chrome-devtools.list_pages --args '{}' --output text
mcporter call chrome-devtools.select_page --args '{"pageId":9}' --output text
mcporter call chrome-devtools.navigate_page --args '{"url":"https://example.com"}' --output text
mcporter call chrome-devtools.take_snapshot --args '{}' --output text
mcporter call chrome-devtools.evaluate_script --args '{"function":"() => document.body.innerText"}' --output json
```

Browser automation unavailable → report as verification gap, don't substitute isolated tooling.

## Secret Handling

Never print tokens/passwords from DOM, network logs, inputs. Token checks: shape only (present/absent, length, status code, account/org).

Files in this skill

  • SKILL.md3.6 KB
  • agents/openai.yaml218 B
  • attribution.txt168 B
  • mcporter-config.md3.9 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.