Skills browser-act

📦

browser-act

Name: browser-act
Author: browser-act

v2.0.2 Content revision r3 High Risk ⚙️ External commands🌐 Network access

Automate Browser Workflows with browser-act

JavaScript-heavy sites and interactive workflows are difficult to handle with basic fetch tools. browser-act provides rendered extraction, browser control, session isolation, and network capture.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "browser-act" from https://skillstore.io/skills/browser-act-browser-act.md and its manifest at https://skillstore.io/api/skills/browser-act-browser-act/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/browser-act-browser-act.md Signed manifest GET /api/skills/browser-act-browser-act/manifest Signed lockfile GET /api/skills/browser-act-browser-act/lockfile

Test it

Using "browser-act". Extract the rendered pricing details from the requested product page.

Expected outcome:

The page shows three plans: Starter, Team, and Enterprise. Team includes shared workspaces, while Enterprise requires a sales inquiry.

Using "browser-act". Inspect the checkout path without submitting an order.

Expected outcome:

The cart opens with one item and an editable quantity.
Checkout requests contact and delivery details.
The review step appears before payment confirmation.
No order was submitted.

Using "browser-act". Investigate why the dashboard stops loading after sign-in.

Expected outcome:

The dashboard shell rendered, but one data request returned an authorization error. Sensitive headers were excluded from the summary.

Security Audit

High Risk

v9 • 7/23/2026 Open versioned report

All seven static alerts are false positives caused by Markdown syntax, ordinary links, or separate screenshot and upload capabilities. However, the skill loads unaudited instructions from the installed CLI and can transmit challenge images to an external verification service.

Files scanned

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

SKILL.md:46-55

Unaudited Runtime Instruction Loading

The stub directs agents to execute browser-act and treat its output as the actual workflow. Those instructions are outside the audited file and can change behavior without marketplace review.

The file explicitly calls itself a discovery stub and requires agents to load operational instructions from CLI output.

High

SKILL.md:13-17

Challenge Image Transmission to External Service

The skill states that solve-captcha can send a challenge image to an external verification API. The service endpoint and retention policy are not identified.

The metadata directly discloses outbound transmission of challenge images, while limiting other local browser data.

Risk Factors

⚙️ External commands (3)

SKILL.md:42 SKILL.md:49-51 SKILL.md:51-55

🌐 Network access (2)

SKILL.md:9 SKILL.md:26

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/browser-act-browser-act/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/browser-act-browser-act/security.svg)](https://skillstore.io/skills/browser-act-browser-act?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/browser-act-browser-act?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/browser-act-browser-act/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/browser-act-browser-act.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

browser-act. (2026). browser-act security audit report (audit version 9) [Author version 2.0.2]. Skillstore. https://skillstore.io/skills/browser-act-browser-act/audits/9

BibTeX citation

@techreport{browser-act-browser-act-browser-act-2026,
  author = {browser-act},
  title = {browser-act security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/browser-act-browser-act/audits/9},
  note = {Author version 2.0.2}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "browser-act security audit report (audit version 9)"
version: "2.0.2"
type: report
authors:
  - name: "browser-act"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/browser-act-browser-act/audits/9"
identifiers:
  - type: other
    value: "skillstore:browser-act-browser-act:audit:9"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Extract Rendered Research

Collect visible content from JavaScript-heavy pages and pages that reveal information after scrolling or interaction.

Verify Web Interfaces

Inspect rendered layouts, capture screenshots, and confirm interactive behavior across browser sessions.

Automate Repeated Operations

Run approved navigation, form, and multi-account workflows while keeping browser profiles isolated.

Try These Prompts

Extract One Page

Open [URL] and extract the main rendered text. Report the page title, key facts, and any content hidden behind interaction.

Inspect a User Flow

Open [URL], follow the path from [start] to [destination], and describe each visible state. Ask before any submission or login.

Compare Isolated Sessions

Create approved isolated sessions for [accounts]. Compare the rendered results at [URL] without sharing cookies or profile data.

Capture Network Evidence

Reproduce [workflow], capture relevant XHR, fetch, and HAR activity, then summarize request timing, failures, and response behavior. Exclude secrets from the report.

Best Practices

Request confirmation before login, submission, upload, browser creation, or deletion.
Use separate browser profiles for different accounts and trust boundaries.
Remove credentials, cookies, and personal data from screenshots and network reports.

Avoid

Do not submit forms, upload files, or solve challenges without explicit user approval.
Do not reuse one authenticated profile across unrelated users or accounts.
Do not load external runtime instructions that have not passed the same security review.

Frequently Asked Questions

What does browser-act automate?

It handles rendered extraction, navigation, page interaction, screenshots, network capture, and isolated browser sessions.

Does it work with JavaScript-heavy websites?

Yes. It runs a browser engine and can extract content produced after JavaScript execution.

Can it preserve authenticated sessions?

Yes. It stores browser profiles locally and supports isolated sessions for separate accounts.

What requires user confirmation?

Installation, browser creation, login, form submission, file upload, and other sensitive operations require approval.

Does it send data outside the machine?

Captcha assistance can send a challenge image to an external verification service. Other listed browser data remains local.

Where do the detailed operating instructions come from?

The repository file directs the agent to load them from the installed browser-act CLI.

Developer Details

Author

browser-act

License

MIT

Author version

v2.0.2

Skillstore revision

Repository

https://github.com/browser-act/skills/tree/main/browser-act

Ref

a39a91716eadede5f4cdefd78178fed4e837a128

Maintenance freshness

7/24/2026

Usage

6 downloads · 83 views

File structure

📄 SKILL.md