Browser Harness ♞BLOCK

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

● agent: wants to upload a file
│
● agent-workspace/agent_helpers.py → helper missing
│
● agent writes it                         agent_helpers.py
│                                                       + custom helper
✓ file uploaded

Install or upgrade browser-harness to the latest stable version with uv using Python 3.12, register the skill from `browser-harness skill`, and connect it to my browser. Ask whether I want local browser recordings enabled; default to no and preserve my existing preference on upgrades. Follow https://github.com/browser-use/browser-harness/blob/main/install.md if setup or connection fails.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: browser-harness
description: "Control a real browser via CDP: clicking, typing, navigation, logged-in sessions, JS-rendered or bot-protected pages. Not for plain HTTP fetches of public content - use curl for those."
---

# browser-harness

Direct browser control via CDP. For task-specific edits, use `agent-workspace/agent_helpers.py`. For setup, install, or connection problems, read https://github.com/browser-use/browser-harness/blob/main/install.md.

## When Not to Use

A basic fetch of public information needs no browser. If a plain HTTP request can read it — a public page, an API, docs — use `curl` or your fetch tool, and leave the browser alone. Use browser-harness when the task needs interaction (click, type, navigate), the user's logged-in session, JS rendering, or a bot-protected page. If a direct fetch fails or returns a shell page, then escalate to the browser.

Domain skills are off by default. Set `BH_DOMAIN_SKILLS=1` to enable them; see the bottom section.

**If `BH_DOMAIN_SKILLS=1` and the task is site-specific, read every file in the matching `$BH_AGENT_WORKSPACE/domain-skills/<site>/` directory before inventing an approach.**

## Usage

```bash
browser-harness <<'PY'
print(page_info())
PY
```

- Invoke as `browser-harness`. Use heredocs for multi-line commands.
- Helpers are pre-imported. `run.py` calls `ensure_daemon()` before `exec`.
- First navigation for a task is `new_tab(url)`, not `goto_url(url)`. The daemon
  preserves the attached tab across separate CLI invocations, so do not call
  `new_tab()` again in every script.
- Keep one working tab per task/site. Before opening another, inspect
  `current_tab()` and `list_tabs()` and use `switch_tab()` to reuse a matching
  tab. Do not leave duplicate tabs on the same URL or close tabs you did not
  create.
- At task completion, close tabs created for the task that are no longer needed.
  Keep a tab open if the user needs to see it, it is needed for a known follow-up,
  or closing it could discard unsaved work or other important state.
- `new_tab()` and `switch_tab()` attach and move the horse marker without
  changing Chrome's visible tab. Screenshots and normal CDP input work in the
  background. Never call `activate_tab(target)` automatically: it brings Chrome
  to the foreground. Call it only when the user explicitly asks to see or
  visibly switch to that tab. Do not pair `switch_tab()` with `activate_tab()`.
- A local daemon is a connection to the whole Chrome instance, not to one site,
  task, card, or agent. Omit `BU_NAME` and reuse the default daemon for normal
  sequential local work across websites, tabs, screenshots, and Codex turns.
  Do not invent per-job names such as `gmail1375` or `slack1371`: every new
  local daemon opens another browser-level CDP connection and Chrome may show
  another Allow prompt.
- Set `BH_TAB_MARKER=0` before starting the daemon to leave page titles unchanged.
  The horse marker remains enabled by default.
- A timeout or page that pauses while hidden is not permission to foreground
  Chrome. Keep using background CDP operations. For a focus-gated page,
  temporarily call `cdp("Emulation.setFocusEmulationEnabled", enabled=True)`,
  perform and verify the operation, then disable it in a `finally` block. If
  background control still cannot work, report that limitation instead of
  activating the tab. Do not invent a `Runtime.evaluate` scroll replacement or
  a cross-frame JS walker.
- The normal local flow attaches to the running Chrome/Chromium CDP endpoint. No browser ids or local profile selection.

## Local Chrome

The default daemon can keep many tabs and visit many sites; browser-harness has
no per-site, screenshot, or result-count limit that requires a new daemon.
Chrome memory and page complexity are the practical limits. Reuse matching tabs
with `list_tabs()` and `switch_tab()`.

One daemon has one mutable attached/current tab. Many agents can share it when
their browser operations are serialized: treat local Chrome as one shared
browser lane while non-browser work continues in parallel. Sequential tab
switching, input, and screenshot capture are safe. Do not create another local
daemon merely because several agents exist.

Two agents that switch tabs and act simultaneously can race, causing one to act
on or capture the other's tab. For truly simultaneous interactive work, use
separate remote browsers when Browser Use Cloud authentication is already
available. Otherwise serialize browser operations through the default local
daemon. A named local daemon is a last resort when simultaneous isolation is
required, remote auth is unavailable or unsuitable, and the extra Chrome
approval prompt is acceptable. It creates another controller and dedicated tab
in the same local Chrome profile, not another Chrome profile or process.

If the default daemon becomes stale, use its built-in reattachment/recovery
first. A command timeout, truncated output, site change, closed tab, or new task
is not a reason to create another daemon. Run `browser-harness --doctor` and
restart or replace the default daemon only when it is actually dead or cannot
recover.

If the daemon cannot connect, run diagnostics:

```bash
browser-harness --doctor
```

If Chrome is not running at all, the harness launches it automatically and retries.

If Chrome is running but remote debugging is not enabled, the harness opens:

```text
chrome://inspect/#remote-debugging
```

On macOS, when local Chrome asks for remote-debugging permission, keep the
original browser command running and call `mac-approve` in another shell/tool
call. Preserve the exact daemon name: if the waiting command used
`BU_NAME=r7k2`, run:

```text
BU_NAME=r7k2 browser-harness mac-approve
```

For the default daemon, omit the `BU_NAME` prefix. The original command resumes
when the helper returns `ready`; do not rerun it. If the helper reports
`accessibility-required`, ask the user once to grant the app launching
browser-harness (for example

BLOCKgrade F · trust 47/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

What the source does

Filesystem

none-observed

Network

declared (11 observation(s))

Shell

declared (1 observation(s))

Dependencies

pinned

Secrets in source

found

Findings (25)

exec(code, globals())

t = t.replace("","").replace("","").replace("","")

10. **Unicode zero-width space in some titles.** `\u200b` (zero-width space) appears at the start of certain titles (e.g. "Our Life: Beginnings & Always"). Strip with `.replace('\u200b', '').strip()`

skills/browser-harness/SKILL.md

src/browser_harness/SKILL.md

return json.loads(urllib.request.urlopen(f"http://127.0.0.1:{port}/json/version", timeout=1).read())["webSocketDebuggerUrl"]

with urllib.request.urlopen(f"http://127.0.0.1:{probe_port}/json/version", timeout=1) as r:

with urllib.request.urlopen(f"http://127.0.0.1:{port}/json/version", timeout=0.3) as response:

API_KEY = "1MOZgmNFxvmljaQR1X9KAij9Mo4xAY3u"

API_KEY = "1MOZgmNFxvmljaQR1X9KAij9Mo4xAY3u"

API_KEY = "1MOZgmNFxvmljaQR1X9KAij9Mo4xAY3u"

API_KEY = "1MOZgmNFxvmljaQR1X9KAij9Mo4xAY3u"

API_KEY = "1MOZgmNFxvmljaQR1X9KAij9Mo4xAY3u"

BU_NAME=qbo BU_CDP_URL=http://127.0.0.1:9223 browser-harness <<'PY'

- **Way 2 (isolated profile, no popups):** launch Chrome with `--remote-debugging-port=9222 --user-data-dir=<non-default path>`, then set `BU_CDP_URL=http://127.0.0.1:9222`. Best for unattended automa

open(path, "wb").write(base64.b64decode(r["data"]))

data = base64.b64decode(shot["data"])

2. Open Test mode and its API keys page. Do not infer account identity from the URL alone.

`curl -fsSL https://browser-use.com/profile.sh | sh`.

curl -fsSL https://browser-use.com/profile.sh | sh

POST `https://my.recruitwithatlas.com/graphql` using the tab's own cookies:

`https://github.com/{owner}/{repo}` — user-triggered actions on the repo header (Star, Unstar, Watch, Unwatch) are HTML forms that POST back to GitHub with the session's CSRF token already rendered in

HLTB runs a token-gated POST endpoint at `/api/find`. You must first fetch a session token from `/api/find/init`, then include it in the search request. Both steps are plain HTTP — no browser required

- **Token system**: Every search requires a fresh token from `/api/find/init`. Token encodes `timestamp::IP|UA|hpKey|hmacHash`. The server validates that the UA used to fetch the token matches the UA

- **Required headers on search POST**: `Origin: https://howlongtobeat.com` AND `Referer: https://howlongtobeat.com/` — missing either causes HTTP 403 or 404. `x-auth-token`, `x-hp-key`, `x-hp-val` are

Gates applied: no_behavioural_pass.

[![ModelsAtlas audit: Browser Harness ♞](https://modelsatlas.com/skills/browser-use/browser/badge.svg)](https://modelsatlas.com/skills/browser-use/browser/)

Not your listing, or something out of date? Claim or update your listing.