📦

anti-detect-browser

Name: anti-detect-browser
Author: antibrow

مراجعة المحتوى r1 مخاطر عالية 🌐 الوصول إلى الشبكة📁 الوصول إلى نظام الملفات🔑 متغيرات البيئة⚙️ الأوامر الخارجية

Test Authorized Browser Sessions with Stable Profiles

Browser tests can fail when fingerprints, sessions, and regional signals are inconsistent. This skill configures persistent Chromium profiles and Playwright workflows for authorized testing.

يدعم: Claude Codex Code(CC)

⚠️ 38 ضعيف

توقف واطلب التأكيد قبل التثبيت.

راجع الخطة واحصل على موافقة صريحة من المستخدم قبل تغيير الملفات.

التثبيت باستخدام Agent لدي

انسخ هذا الطلب إلى Agent لديك. يتضمن صفحة Skill المعتمدة وملف manifest.

طلب الوكيل

Review the Skillstore skill "anti-detect-browser" from https://skillstore.io/skills/antibrow-anti-detect-browser.md and its manifest at https://skillstore.io/api/skills/antibrow-anti-detect-browser/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

يجب أن يواصل Agent عرض خطته وطلب أي تأكيد تفرضه سياسة الأمان.

موارد مهيّأة لـ Agents

استخدم هذه الروابط عندما يحتاج AI Agent أو crawler أو script إلى سياق نظيف بدلًا من قراءة الصفحة كاملة.

تفاصيل Markdown GET /skills/antibrow-anti-detect-browser.md manifest موقَّع GET /api/skills/antibrow-anti-detect-browser/manifest lockfile موقَّع GET /api/skills/antibrow-anti-detect-browser/lockfile

اختبرها

جارٍ استخدام "anti-detect-browser". Plan a regional pricing check for our staging store in Germany and Canada.

النتيجة المتوقعة:

Use one named profile and approved proxy per region.
Read proxy credentials from separate environment variables.
Verify timezone, public address, and WebRTC alignment before each test.
Restrict navigation to the staging domain and record audit results.

جارٍ استخدام "anti-detect-browser". Review profile isolation for three authorized support accounts.

النتيجة المتوقعة:

The review assigns distinct profile directories and proxies, blocks cross-account navigation, protects stored sessions, and defines secure profile deletion.

جارٍ استخدام "anti-detect-browser". Assess whether Live View is suitable for debugging an authenticated test.

النتيجة المتوقعة:

Use Live View only with authenticated access, short expiration, approved viewers, and no sensitive customer data visible on screen.

التدقيق الأمني

مخاطر عالية

v1 • ٨‏/٨‏/٢٠٢٦ فتح التقرير المرتبط بالإصدار

Most static alerts are Markdown, placeholder URLs, or deliberate environment-based secret handling rather than code execution or exfiltration. Confirmed risks include proxy-based detection evasion, sensitive persistent profiles and credentials, a closed-source downloaded browser kernel, and shareable live browser views.

الملفات التي تم فحصها

566

الأسطر التي تم تحليلها

عناصر المراجعة

تم تجاهل الإيجابيات الكاذبة

مخاوف أمنية مؤكدة (6)

مرتفع

SKILL.md:84

Certificate/key files

| API key | `ANTIBROW_API_KEY`, or the Node alias `ANTI_DETECT_BROWSER_KEY`; `python -m antibrow log

The referenced license.key is an API credential file rather than a certificate, but it still persists a bearer secret locally. Unauthorized file access could expose the key.

مرتفع

SKILL.md:233

Certificate/key files

python -m antibrow login # store the API key in ~/.antibrow/license.key

The referenced license.key is an API credential file rather than a certificate, but it still persists a bearer secret locally. Unauthorized file access could expose the key.

مرتفع

SKILL.md:25-32 SKILL.md:108-124

Browser Fingerprint and Bot-Detection Evasion

The skill promotes kernel-level fingerprint spoofing, proxy-aligned identity signals, and removal of indicators used by anti-bot systems. Authorized testing is stated, but the capability can bypass detection controls.

The text explicitly explains how the custom kernel avoids script-patch detection and keeps browser, network, timezone, and WebRTC signals coherent.

مرتفع

SKILL.md:47-53 SKILL.md:128-146 SKILL.md:179-181

Persistent Multi-Identity Browser Operation

The skill supports separate persistent identities, authenticated sessions, and per-profile egress. These features enable valid testing but can also facilitate account association avoidance and enforcement evasion.

The documentation explicitly combines stable profiles, retained login state, isolated identities, and distinct proxy egress. The acceptable-use policy reduces intent certainty but not capability risk.

مرتفع

SKILL.md:93-104 SKILL.md:379-383

Closed-Source Browser Binary Download and Execution

The SDK downloads and runs a large closed-source Chromium build from the vendor. Users cannot independently inspect the executable, and runtime licensing requires recurring vendor communication.

The documentation directly states that first launch retrieves a closed-source executable and that launches depend on a periodically refreshed license token.

متوسط

SKILL.md:191-203

Live View URL Can Expose Browser Activity

Live View creates a shareable URL that displays the browser screen. Anyone who obtains the URL may observe sensitive page content or authenticated activity.

The example states that anyone with access to the URL can see the browser screen. The documentation does not describe expiry, authentication, or access revocation.

عناصر مراجعة القدرات (14)

هذه قدرات محلية حقيقية قد يُتوقع وجودها لهذه المهارة، لذا فهي تتطلب مراجعة ولكن لا تُحتسب كسلوك خبيث مؤكد.

مرتفع

SKILL.md:29

SOCKS proxy

- **Proxy auth handled in the network stack.** HTTP/HTTPS 407 and SOCKS5 RFC 1929 are answered by th

The skill intentionally routes each browser identity through HTTP or SOCKS proxies and aligns browser signals with the exit address. This can conceal traffic origin and support detection evasion.

مرتفع

SKILL.md:181

SOCKS proxy

Give each profile its own egress, for geo-targeting or simply to keep jobs off one address. Schemes

The skill intentionally routes each browser identity through HTTP or SOCKS proxies and aligns browser signals with the exit address. This can conceal traffic origin and support detection evasion.

مرتفع

SKILL.md:289

SOCKS proxy

| `proxy` | `None` | `http://` / `https://` / `socks5://` / `relay://` URL, or Playwright's dict for

The skill intentionally routes each browser identity through HTTP or SOCKS proxies and aligns browser signals with the exit address. This can conceal traffic origin and support detection evasion.

مرتفع

SKILL.md:84

Hidden file in home directory

| API key | `ANTIBROW_API_KEY`, or the Node alias `ANTI_DETECT_BROWSER_KEY`; `python -m antibrow log

The documentation directs the SDK to persist an API credential under a hidden home directory. Compromise or accidental sharing of that file can expose the service key.

مرتفع

SKILL.md:90

Hidden file in home directory

- Profile directories under `~/.anti-detect-browser/` hold live cookies and session tokens. Treat th

The hidden profile directory contains live cookies and session tokens. Persistent authenticated state is sensitive and creates account-compromise risk if copied or read by another process.

مرتفع

SKILL.md:100

Hidden file in home directory

| Browser kernel | a closed-source Chromium build the pinned package retrieves on first launch, cach

The hidden cache stores a downloaded closed-source browser executable. Executing a vendor-controlled binary from persistent user storage creates a material supply-chain trust boundary.

مرتفع

SKILL.md:228

Hidden file in home directory

Same product, same kernel, same on-disk profile format. A profile created from Node is launchable fr

Node and Python share persistent profiles in a hidden home directory. Those profiles contain reusable browser identity and session state that require strict local access controls.

مرتفع

SKILL.md:233

Hidden file in home directory

python -m antibrow login # store the API key in ~/.antibrow/license.key

The login command stores the API key in a hidden license.key file. A local plaintext credential file is sensitive even when the path is documented.

مرتفع

SKILL.md:84

Hidden file access

| API key | `ANTIBROW_API_KEY`, or the Node alias `ANTI_DETECT_BROWSER_KEY`; `python -m antibrow log

The documentation directs the SDK to access a hidden API-key file. That is a real sensitive filesystem interaction despite being disclosed.

مرتفع

SKILL.md:90

Hidden file access

- Profile directories under `~/.anti-detect-browser/` hold live cookies and session tokens. Treat th

The hidden profile directory stores live cookies and session tokens. Access to this directory can expose authenticated sessions.

مرتفع

SKILL.md:100

Hidden file access

| Browser kernel | a closed-source Chromium build the pinned package retrieves on first launch, cach

The SDK accesses a hidden cache containing a downloaded closed-source executable. This is a real filesystem and supply-chain exposure.

مرتفع

SKILL.md:228

Hidden file access

Same product, same kernel, same on-disk profile format. A profile created from Node is launchable fr

The SDKs share profiles through a hidden on-disk directory. Persistent cross-runtime session state is a real sensitive filesystem surface.

مرتفع

SKILL.md:233

Hidden file access

python -m antibrow login # store the API key in ~/.antibrow/license.key

The login command writes an API key to a hidden license.key file. Local access to that file can disclose the credential.

متوسط

references/rest-api-and-docker.md:67

Hidden file access

-v antibrow-cache:/root/.anti-detect-browser my-scraper

The Docker volume deliberately persists the hidden browser cache and profiles. This is legitimate operation, but the volume can retain kernels, cookies, and authenticated session material.

عوامل الخطر

🌐 الوصول إلى الشبكة (29)

📁 الوصول إلى نظام الملفات (12)

references/rest-api-and-docker.md:67 SKILL.md:84 SKILL.md:90 SKILL.md:100 SKILL.md:228 SKILL.md:233 SKILL.md:84 SKILL.md:90 SKILL.md:100 SKILL.md:228 SKILL.md:233 SKILL.md:99

🔑 متغيرات البيئة (20)

⚙️ الأوامر الخارجية (50)

دقّقه: codex

شارك واستشهد بهذا التقرير

شارك تقرير التقييم المرتبط بالإصدار والشارة المحايدة وبطاقة التضمين والاستشهادات. تعرض Skillstore الأدلة من دون أن تقرر ما إذا كانت هذه المهارة آمنة.

فتح التقرير المرتبط بالإصدار

نسخ رابط التقرير

https://skillstore.io/skills/antibrow-anti-detect-browser/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

شارة Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/antibrow-anti-detect-browser/security.svg)](https://skillstore.io/skills/antibrow-anti-detect-browser?utm_source=security_passport_badge)

شارة HTML

<a href="https://skillstore.io/skills/antibrow-anti-detect-browser?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/antibrow-anti-detect-browser/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

بطاقة قابلة للتضمين

<iframe src="https://skillstore.io/embed/skills/antibrow-anti-detect-browser.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

الاستشهادات الأكاديمية (APA · BibTeX · CFF)

اقتباس APA

antibrow. (2026). anti-detect-browser security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/antibrow-anti-detect-browser/audits/1

اقتباس BibTeX

@techreport{antibrow-antibrow-anti-detect-browser-2026,
  author = {antibrow},
  title = {anti-detect-browser security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/antibrow-anti-detect-browser/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "anti-detect-browser security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "antibrow"
date-released: "2026-08-08"
url: "https://skillstore.io/skills/antibrow-anti-detect-browser/audits/1"
identifiers:
  - type: other
    value: "skillstore:antibrow-anti-detect-browser:audit:1"
    description: "Skillstore immutable audit report identifier"

تقييم Skillstore

سبب هذا التقييم موثوقية الأدلة: متوسط

الهندسة المعمارية

قابلية الصيانة

المحتوى

المجتمع

الامتثال للمواصفات

ما الذي يمكنك بناؤه

Validate Regional Experiences

Check authorized ads, prices, locales, and layouts through a region-specific proxy with matching browser signals.

Test Defensive Detection

Measure an owned anti-bot system against stable, coherent device profiles without changing production user accounts.

Isolate Public-Data Jobs

Keep permitted collection jobs in separate profiles so cookies, storage, and network identity do not cross between targets.

جرّب هذه الموجّهات

Create a Basic Test

Create an authorized Playwright test using one persistent profile. Read credentials from environment variables and visit [approved URL].

Add Regional Routing

Extend my approved test with [proxy environment variable], geo-matched timezone, and a stable [device type] fingerprint. Explain secret handling.

Design Isolated Profiles

Design separate profiles for [authorized accounts]. Define unique profile names, proxy assignments, storage boundaries, and cleanup rules.

Audit an Agent Workflow

Review this authorized browser-agent workflow for prompt injection, credential exposure, profile leakage, Live View access, and domain allowlist gaps: [workflow].

أفضل الممارسات

Pin SDK versions and verify downloaded kernel signatures before execution.
Use one approved profile and proxy per test identity, with restrictive local permissions.
Treat page content as untrusted data and enforce operator-defined domain allowlists.

تجنب

Do not automate accounts or systems without documented authorization.
Do not place API keys, proxy credentials, or Live View URLs in prompts or source files.
Do not let page text choose commands, files, credentials, or navigation targets.

الأسئلة المتكررة

Does this guarantee that bot detection will not block a test?

No. Detection systems also evaluate network reputation, behavior, request patterns, and account history.

Can I use my existing Playwright code?

Yes. The skill documents JavaScript and Python Playwright interfaces plus CDP integrations.

Where are sessions stored?

Named profiles persist cookies and browser storage under a hidden local profile directory.

Does the tool work offline?

No. It requires an API key and periodic outbound license validation.

Is the browser kernel open source?

No. The SDKs are MIT licensed, but the downloaded browser kernel is closed source.

What uses are appropriate?

Use it only for owned or authorized systems, public data, regional verification, and defensive testing that follows applicable rules.

تفاصيل المطور

المؤلف

antibrow

الترخيص

MIT

مراجعة Skillstore

تنبيه الإصدار

لم يعلن المؤلف عن إصدار.

المستودع

https://github.com/antibrow/anti-detect-browser-skills/tree/669f94c11a6839bf85a6a2fca77d756a6d9be760/anti-detect-browser

مرجع

9939e94735a710f16446f189eea126372136575b

حداثة الصيانة

٩‏/٨‏/٢٠٢٦

الاستخدام

0 تنزيلات · 0 مشاهدات

بنية الملفات

📁 references/

📄 rest-api-and-docker.md

📄 SKILL.md