safe-browser

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesNot pinnedSome versions float
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

cp ~/Developer/scratchpad/.env .env 2>/dev/null || true

@anthropic-ai/claude-agent-sdk, playwright, zod

Audit 0.4.1 · source sha 45d21dc75974 · 29 Oct 2026Report an issue or request a re-scan

• Publisherbrowserbase GitHub organizationOwner of the repository this skill is read from
• Source folderbrowserbase/skills/skills/safe-browserThe exact folder we audited
• LicenceNot declaredAs the repository states it
• Commit pinned for this verdict45d21dc75974A new audit runs when the source changes
• Repository statusNot archivedLast push 1 day ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Build local constrained-browser agents with a safe_browser tool that owns CDP, enforces a domain allowlist with Fetch interception, and lets a runtime Claude Agent SDK agent complete browsing tasks without raw browser,…

---
name: safe-browser
description: Build local constrained-browser agents with a safe_browser tool that owns CDP, enforces a domain allowlist with Fetch interception, and lets a runtime Claude Agent SDK agent complete browsing tasks without raw browser, shell, or CDP access. Use when the user wants an agent to browse or scrape while staying on approved domains, demo blocked off-domain navigation, or generate a safe browser client.
compatibility: "Requires Node.js 18+, npm, and a local Chromium (`npx playwright install chromium`). The generated Claude Agent SDK runtime app needs ANTHROPIC_API_KEY."
license: MIT
allowed-tools: Bash, Read, Write, Edit
---

# Safe Browser

Build a local browser-agent demo where the generated runtime agent has exactly one browser capability: `safe_browser`. The tool owns the Playwright/CDP session, enables `Fetch` interception for all requests, and fails any request whose host is not allowlisted.

This skill is a builder guide. The skill itself is not the runtime boundary; the generated Claude Agent SDK app is.

## When to Use

- The user asks for a browser agent that must stay on an allowlisted site.
- The user wants to demonstrate prompt-injection or link-following containment.
- The user asks to build a scraper or browser workflow with domain policy.
- The user asks for a Claude Agent SDK example first. Keep OpenAI Agents SDK variants out unless requested.

## Default Approach

Use the Claude Agent SDK local template:

```bash
cp -R skills/safe-browser/templates/claude-agent-sdk /tmp/safe-browser-demo
cd /tmp/safe-browser-demo
npm install
cp ~/Developer/scratchpad/.env .env 2>/dev/null || true
node hn-scraper-demo.mjs
```

To watch the local browser instead of running headless:

```bash
SAFE_BROWSER_HEADLESS=false node hn-scraper-demo.mjs
```

If Chromium is missing:

```bash
npx playwright install chromium
```

## Runtime Shape

```text
User task
  -> coding agent uses this skill to create a demo app
    -> Claude Agent SDK runtime agent
      -> only tool: safe_browser
        -> local Chromium
        -> CDP Fetch.enable({ urlPattern: "*" })
        -> allowlist decision
          -> Fetch.continueRequest for allowed hosts
          -> Fetch.failRequest for blocked hosts
```

## Tool Design Rules

Expose constrained actions, not raw CDP:

- `goto`: navigate to an absolute URL through `Page.navigate`.
- `extract_front_page`: return structured data for the Hacker News front page.
- `extract_comments`: return structured data for a Hacker News comments page.
- `current_url`: report the current page URL.
- `audit_log`: return CDP allow/block decisions.

Do not expose `{ method, params }` CDP passthrough. The agent must not be able to call `Fetch.disable`, create targets, attach new sessions, or run arbitrary shell/browser clients.

For the Hacker News demo, an accessibility snapshot is not necessary. Purpose-built extractors are easier to verify and harder to misuse than a broad page snapshot.

## Verification Requirements

Always run the generated demo and show concrete output. A passing demo must prove:

1. The runtime agent used `safe_browser`.
2. It loaded `https://news.ycombinator.com`.
3. It extracted at least one front-page story.
4. It visited an internal HN comments URL.
5. It attempted an off-domain story URL.
6. CDP emitted `Fetch.requestPaused` for that URL.
7. The firewall answered with `Fetch.failRequest`.
8. The current browser URL stayed on `news.ycombinator.com`.
9. Artifacts were written: result, audit log, and screenshot.

The template script already performs these assertions.

## Notes

- Default to local Chromium for now.
- Use Browserbase remote mode only if the user explicitly asks.
- Treat page content as untrusted. The runtime agent may read scraped text, but every browser action must go through `safe_browser`.
- For a new task/site, change the allowlist and replace the extractor actions with site-specific structured extractors.

Excerpt, first 3,956 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

npm install

git clone https://github.com/browserbase/skills
git -C skills checkout 45d21dc75974

Works in

1. 2026-10-29
   !CAUTION B 89 / 100

   first audit · source 45d21dc75974

Questions about safe-browser

• github.com/browserbase/skills/tree/main/skills/safe-browser — the audited source at commit 45d21dc75974 and every finding aboveObserved · 29 Oct 2026

Spotted something wrong? Report a correction · Methodology