
from browser-harness-js458
Run persistent CDP sessions from JavaScript via the browser-harness-js CLI to automate, inspect, and script Chrome with a long-lived typed Session and preserved
The browser-harness-js skill provides a tiny server-backed CDP runtime and a CLI that evaluates JavaScript snippets against a persistent, fully-typed DevTools Protocol Session. The tool keeps a reusable session (and globals) across invocations so agents can drive navigation, DOM queries, screenshots, network interception, and multi-tab flows without re-establishing connections. Output is returned as raw values or compact JSON, and errors surface to stderr for easy automation.
Use this skill when you need reliable programmatic control of Chrome from an agent or script: cross-tab automation, DOM inspection, runtime evaluation, screenshot capture, or attaching to a running browser. It is ideal when maintaining state across calls matters (preserved session, event listeners, globals).
sdk/ (server, session, generated bindings)Works well with agents that can call CLIs and run short JS snippets (Claude Code, Cursor, Node-based agents) and with developer tooling that benefits from a persistent CDP connection.
CDP browser-harness-js skill provides a typed SDK and CLI for automating Chrome via the DevTools Protocol. The SKILL.md is thorough with clear setup, usage, and API docs. No bundled scripts to test. Security concerns: the skill instructs agents to symlink a binary into /usr/local/bin or /opt/homebrew/bin (requires sudo on some systems), auto-installs bun on first run, and runs an HTTP server on localhost:9876. The auto-install of bun and symlinking into system paths reduces the security score. Shell injection risk is moderate since CLI args are passed as JS strings.
Well-documented skill with comprehensive SKILL.md. The main security deductions: auto-installing bun without user confirmation (-18 auto-update-like mechanism), symlinking into system PATH dirs (-12 shell injection risk from unquoted paths in symlink commands), and localhost HTTP server exposure (-10). No hardcoded credentials, no data exfiltration, no destructive commands. Useful for browser automation but niche audience (developers needing CDP access via CLI).