Skip to content
Back to skills

Browserbase

CSecurity

Use when working with Browserbase or the browse CLI.

  • 36 stars
  • 0 votes
  • 0 copies
  • 2 views
  • Added September 10, 2026
ai-agentstypescriptpythonrustbashnodeapi

Works with

  • cli
  • api

Security analysis

C71/100
  • criticalSends environment variables or credentials to an external URL
  • mediumInstalls packages at runtime which could introduce malicious dependencies

Pro scans all 2 files and shows the line behind each finding

Scanned September 10, 2026

npx -y skills add theheavenlyd3mon/hermes-profiles --skill browserbase --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Browserbase?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Browserbase
[![Security: C — Skills Directory](https://www.skillsdirectory.com/api/skills/theheavenlyd3mon-browserbase/badge)](https://www.skillsdirectory.com/skills/theheavenlyd3mon-browserbase)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: browserbase
description: "Use when working with Browserbase or the browse CLI."
version: 1.0.0
author: Hermes Agent Team
license: MIT
metadata:
  hermes:
    tags: [browserbase, browse-cli, web-scraping, browser-automation, stagehand]
    related_skills: [gated-content-retrieval, safe-web-research]
---

# Browserbase (`browse` CLI)

Browserbase runs real Chrome browsers in the cloud that code or an agent can drive. The unified CLI is `browse` (v0.9.6+). **The API key alone resolves the project — there is NO `BROWSERBASE_PROJECT_ID` anywhere.** Never ask for one, never add it to `.env`, never pass `projectId` to a constructor. Older docs/training say it's required — that's outdated.

## Key location (this machine)

Current key lives in `~/.hermes/.env` as `BROWSERBASE_API_KEY`. Stale keys can linger in profile env files (`~/.hermes/profiles/*/.env`) — when a prompt shares a key, verify it matches the `.env` key before trusting it. Env may also export `BROWSERBASE_PROXIES=true` / `BROWSERBASE_ADVANCED_STEALTH=false`.

To run CLI commands: `export BROWSERBASE_API_KEY=$(grep "^BROWSERBASE_API_KEY=" ~/.hermes/.env | sed 's/^BROWSERBASE_API_KEY=//')`

## Setup & verify

```bash
browse --version && node --version    # both present → skip install
npm install -g browse@latest          # only if missing
npm uninstall -g @browserbasehq/cli @browserbasehq/browse-cli  # only if deprecated CLI shadows `browse` ("unknown command 'cloud'")
browse cloud projects list            # access check — returns projects if key works. Do NOT pick/copy a project id from it.
```

Every CLI command prints an **"Update available" banner** — informational noise, not an error. Strip it before parsing JSON: `browse ... 2>&1 | grep -v "Update available"`.

## Core commands

- **Fetch** (page content, no browser session): `browse cloud fetch "<url>" --format markdown` → JSON; extract the page with `.content`. Returns a payload, NOT a session row.
- **Search** (find URLs): `browse cloud search "<query>" --num-results N --json`
- **Sessions**: `browse cloud sessions list` — Fetch/Search don't create session rows; success for those is the 200/payload, not a new session.
- **Templates**: `browse templates list` (JSON). **Confirm a slug exists before cloning — slugs drift** (e.g. `amazon-product-scraping` no longer exists; closest is `gift-finder`). Clone into a disposable `/tmp` sandbox: `browse templates clone <slug> /tmp/<slug> --language typescript`.
- **Skills catalog**: `browse skills find "<task>" --json`, then `browse skills add <domain>/<task>`.
- **Driving a session**: `browse open <url>`, `browse snapshot`, `browse click/fill/get`, `browse doctor`, `browse cdp`.

## Free-tier constraints

- **Model Gateway**: included on Free but capped at **$5 of tokens** — Stagehand `act/extract/agent` can fail partway once spent. Leave `MODEL_API_KEY` (and other LLM provider keys) **blank**; a placeholder value triggers a misleading "API key not valid".
- **Proxies / Verified / auto-CAPTCHA**: paid tiers. Warn before running against bot-protected or auth-walled sites (LinkedIn, Yelp, Instagram, ticketing). Server-rendered sites (XenForo forums, docs sites) fetch fine on Free without proxies — test with Fetch before reaching for a browser session.

## Bulk fetch pattern

For multi-page scraping, loop `browse cloud fetch`, strip the banner, extract `.content` via python, write to files — see `references/bulk-fetch-recipe.md` for the exact loop.

## Pitfalls

- Don't pipe `browse` JSON through `head`/`cut`/`grep` in a way that clips session ids — surface full links verbatim.
- `browse` unified CLI ≠ deprecated `@browserbasehq/cli`. If `browse cloud` says "unknown command", uninstall the deprecated package.
- After a `browse templates clone`, follow the clone's printed "Next steps" for install/run (TS → `npm`, Python → `uv`/pip).

Files in this skill

  • SKILL.md3.8 KB
  • references/bulk-fetch-recipe.md1.7 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.