Skills go-rod-master

📦

go-rod-master

Name: go-rod-master
Author: sickn33

Content revision r1 High Risk ⚡ Contains scripts⚙️ External commands🌐 Network access

Build Go Browser Automation with Rod

Dynamic sites make simple HTTP scraping unreliable. This skill shows how to automate Chromium with go-rod for scraping, testing, request interception, and debugging.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "go-rod-master" from https://skillstore.io/skills/sickn33-go-rod-master.md and its manifest at https://skillstore.io/api/skills/sickn33-go-rod-master/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/sickn33-go-rod-master.md Signed manifest GET /api/skills/sickn33-go-rod-master/manifest Signed lockfile GET /api/skills/sickn33-go-rod-master/lockfile

Test it

Using "go-rod-master". Create a basic go-rod scraping workflow for one approved documentation page.

Expected outcome:

The result is a concise implementation plan: launch Chromium, open the page, wait for stable content, extract the title and links, then close resources.

Using "go-rod-master". Review my flaky page automation task.

Expected outcome:

The response identifies fragile waits, recommends explicit timeouts, suggests error-returning APIs, and adds cleanup steps for browser pages and routers.

Using "go-rod-master". Plan a safe concurrent scrape for a small allowlisted URL set.

Expected outcome:

The output proposes a bounded page pool, rate limits, isolated contexts, retry boundaries, logging fields, and a permission checklist.

Security Audit

High Risk

v6 • 7/9/2026 Open versioned report

Most static findings are false positives caused by Go import blocks, Markdown backticks, documentation links, or local screenshot examples. The real risks are semantic: the skill teaches bot-detection evasion, proxy use, request tampering, and script response modification for browser automation.

Files scanned

996

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (4)

High

SKILL.md:153-166 SKILL.md:491-502 SKILL.md:514-529 examples/stealth_page.go:14-36

Anti-Bot Evasion Guidance

The skill explicitly recommends stealth pages for real-world sites and lists fingerprint evasions such as removing webdriver signals, spoofing WebGL, and changing browser traits. This guidance can help bypass bot-detection controls on third-party services.

Multiple sections directly instruct anti-detection behavior and the example verifies evasions against a bot-detection test page.

High

SKILL.md:299-318 examples/request_hijacking.go:33-54

Request Tampering and Script Modification Guidance

The skill teaches intercepting requests, changing authorization headers, and modifying JavaScript responses in transit. These capabilities can be used for traffic tampering or unauthorized instrumentation outside owned test environments.

The documentation and runnable example both show header modification and response body modification using Rod request hijacking.

High

SKILL.md:259-273

Proxy and Certificate-Bypass Guidance

The proxy section shows browser traffic routed through local proxies and instructs ignoring certificate errors for MITM proxies. Combined with scraping and stealth guidance, this increases misuse risk for interception or evasion.

The cited section explicitly combines proxy configuration, proxy authentication, and certificate-error bypass language for MITM proxy use.

Medium

SKILL.md:1-5 SKILL.md:27-33 SKILL.md:153-166 SKILL.md:299-318

Misleading Safety Self-Classification

The skill declares itself safe and says it has no external mutations by default, but later provides stealth, proxy, request hijacking, and response modification patterns. This mismatch can cause users or agents to underestimate the security and abuse risk.

The safety claim and risk label are present in the file, and later sections clearly document higher-risk browser evasion and traffic modification behaviors.

Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:264

SOCKS proxy

Proxy("socks5://127.0.0.1:1080").

The skill documents SOCKS proxy routing for automated browser traffic. In the surrounding stealth scraping context, proxy use can support anonymized scraping and evasion.

Risk Factors

⚡ Contains scripts (5)

examples/basic_scrape.go:3-9 examples/concurrent_pages.go:3-10 examples/request_hijacking.go:3-11 examples/stealth_page.go:3-12 SKILL.md:173-176

⚙️ External commands (50)

examples/basic_scrape.go:25 SKILL.md:32 SKILL.md:37-43 SKILL.md:43-47 SKILL.md:47-49 SKILL.md:49-57 SKILL.md:57-68 SKILL.md:68-76 SKILL.md:76 SKILL.md:77 SKILL.md:81-89 SKILL.md:89-93 SKILL.md:93-100 SKILL.md:100-104 SKILL.md:104-106 SKILL.md:106-114 SKILL.md:114-120 SKILL.md:120-132 SKILL.md:132-138 SKILL.md:138-149 SKILL.md:149-155 SKILL.md:155 SKILL.md:159-161 SKILL.md:161-163 SKILL.md:163-164 SKILL.md:164-165 SKILL.md:165-172 SKILL.md:172-184 SKILL.md:184-188 SKILL.md:188-194 SKILL.md:194-198 SKILL.md:198-204 SKILL.md:204-210 SKILL.md:210-214 SKILL.md:214-217 SKILL.md:217-218 SKILL.md:218-219 SKILL.md:219 SKILL.md:220-228 SKILL.md:228-230 SKILL.md:230-242 SKILL.md:242-246 SKILL.md:246-257 SKILL.md:257-261 SKILL.md:261-274 SKILL.md:274-278 SKILL.md:278-295 SKILL.md:295-299 SKILL.md:299-321 SKILL.md:321-325

🌐 Network access (32)

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/sickn33-go-rod-master/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-go-rod-master/security.svg)](https://skillstore.io/skills/sickn33-go-rod-master?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/sickn33-go-rod-master?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-go-rod-master/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/sickn33-go-rod-master.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

sickn33. (2026). go-rod-master security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-go-rod-master/audits/6

BibTeX citation

@techreport{sickn33-sickn33-go-rod-master-2026,
  author = {sickn33},
  title = {go-rod-master security audit report (audit version 6)},
  institution = {Skillstore},
  year = {2026},
  number = {6},
  url = {https://skillstore.io/skills/sickn33-go-rod-master/audits/6},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "go-rod-master security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
  - name: "sickn33"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/sickn33-go-rod-master/audits/6"
identifiers:
  - type: other
    value: "skillstore:sickn33-go-rod-master:audit:6"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Automate Dynamic Pages

Create Go workflows that load JavaScript-heavy pages, wait for content, and extract visible data.

Test Browser Workflows

Validate forms, navigation, downloads, screenshots, and page events with Chromium automation.

Prototype Compliant Scrapers

Design limited scraping jobs with timeouts, page pools, and clear resource cleanup.

Try These Prompts

Create a Basic Scraper

Use go-rod to outline a simple browser automation workflow that opens one approved URL, waits for the title, extracts visible text, and closes Chromium.

Add Reliable Waiting

Review my go-rod browser automation flow and suggest waits, timeouts, and error-handling changes that make it reliable for production use.

Design Concurrent Automation

Design a go-rod page pool for a small list of approved URLs. Include concurrency limits, cleanup steps, and failure handling.

Audit Advanced Browser Controls

Analyze a go-rod plan that uses request interception, screenshots, proxy settings, or stealth mode. Identify security, privacy, and compliance risks before implementation.

Best Practices

Use error-returning APIs, explicit timeouts, and cleanup calls in production workflows.
Run automation only against approved targets and respect site terms and privacy rules.
Limit concurrency, store only required outputs, and protect screenshots or downloads.

Avoid

Using stealth, proxies, or fingerprint changes to bypass access controls.
Running broad concurrent scraping without rate limits or target permission.
Saving screenshots, downloads, or network logs that contain sensitive data without controls.