VibiumBLOCK

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

npm install -g vibium
vibium setup

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: browser
description: Automate browsers with the Vibium CLI. Use to navigate websites, inspect pages, fill forms, extract page data, debug UI behavior, capture screenshots and recordings, or delegate browser goals with vibium run.
---

# Vibium Browser Automation — CLI Reference

The `vibium` CLI automates Chrome (and Firefox, via `--engine firefox`) from the command line. The browser auto-launches on first use (daemon mode keeps it running between commands).

Use this skill for browser automation, exploration, debugging, and recording.
Choose explicit CLI commands when you know the steps, or use `vibium run`
when a model should work out how to accomplish a browser goal.

For an independent acceptance verdict, use the `check` skill if installed,
or `vibium check "<claim>"`. Run’s `completed` result and your own browser
observations do not substitute for that invocation.

## Core Workflow

For direct browser commands, use this pattern:

1. **Navigate**: `vibium go <url>`
2. **Map**: `vibium map` (get element refs like `@e1`, `@e2`)
3. **Interact**: Use refs to click, fill, select — e.g. `vibium click @e1`
4. **Re-map**: After navigation or DOM changes, get fresh refs with `vibium map`

## Binary Resolution

Before running any commands, resolve the `vibium` binary path once:

1. Try `vibium` directly (works if globally installed via `npm install -g vibium`)
2. Fall back to `./clicker/bin/vibium` (dev environment, in project root)
3. Fall back to `./node_modules/.bin/vibium` (local npm install)

Run `vibium --help` (or the resolved path) to confirm. Use the resolved path for all subsequent commands.

**Windows note:** Use forward slashes in paths (e.g. `./clicker/bin/vibium.exe`) and quote paths containing spaces.

## Browser readiness

During initial setup, run `vibium ready browser --json` with the engine/channel
that the workflow will use. It inspects installed browser and driver files
without launching them or touching existing sessions. Passing confirms the
installation, not browser launch or BiDi connectivity. If installation is missing, use the reported `vibium install`
command and retry. Direct browser work does not need AI configuration.
Do not rerun readiness before every action when setup is unchanged.

## Delegate a browser goal with Run

Use `vibium run "<goal>"` when the task is clear but the sequence of browser
actions needs investigation. For known steps, use the commands below directly.
Run uses the existing local Chrome or Firefox session and a fresh model context.
Keep the same `--session` or `VIBIUM_SESSION` throughout the workflow.

Load the project's configured AI settings in the shell running the CLI. Settings
in an environment file must use exported assignments (`export NAME=value`).
Run `vibium ready ai --json` during initial setup or after configuration changes;
`result.ready: true` means the provider tool round-trip passed. Never print
credentials. Direct browser commands do not require a model or AI readiness.

With a settings page already open:

```sh
vibium run "Change the timezone to America/Chicago and save it" --json -o browser-run.zip
```

`vibium "<multiword goal>"` is shorthand for Run. Use explicit `run` in scripts
or when the prompt could be mistaken for a command.

Read `result.status` (`completed` or `not_completed`), the summary, and evidence.
Execution failures return an error. If independent verification is needed,
follow with the `check` skill or `vibium check "<claim>"` in the same session;
Check starts another fresh model context.

`-o` saves a recording to a new path. An existing recording is exported without
stopping it. A browser that Run starts closes afterward unless `--keep-open`
is set; a browser already open stays open. Run can change application state.

Run and Check share `VIBIUM_AI_*` defaults. Per-call `--provider`, `--model`,
`--ai-base-url`, and `--reasoning-effort` also work with `vibium ready ai`. When changing
provider, supply a model explicitly; inherited endpoint and effort settings
are cleared. Credentials remain in the provider's environment variable.
Use the project's chosen provider rather than silently switching it.

## Command Chaining

Chain commands with `&&` to run them sequentially. The chain stops on first error:

```sh
vibium go https://example.com && vibium map && vibium click @e3 && vibium diff map
```

**When to chain:** Use `&&` for sequences that should happen back-to-back (navigate → interact → verify). Run commands separately when you need to inspect output between steps.

**When NOT to chain:** Don't chain commands that depend on parsing the previous output (e.g. reading map output to decide what to click). Run those separately so you can analyze the result first.

## Commands

### Discovery
- `vibium map` — map interactive elements with @refs (recommended before interacting)
- `vibium map --selector "nav"` — scope map to elements within a CSS subtree
- `vibium diff map` — compare current vs last map (see what changed)

### Navigation
- `vibium go <url>` — go to a page
- `vibium back` — go back in history
- `vibium forward` — go forward in history
- `vibium reload` — reload the current page
- `vibium url` — print current URL
- `vibium title` — print page title

### Reading Content
- `vibium text` — get all page text
- `vibium text "<selector>"` — get text of a specific element
- `vibium html` — get page HTML (use `--outer` for outerHTML)
- `vibium find "<selector>"` — find element, return `@e1` ref (clickable with `vibium click @e1`)
- `vibium find "<selector>" --all` — find all matching elements → `@e1`, `@e2`, ... (`--limit N`)
- `vibium find text "Sign In"` — find element by text content → `@e1`
- `vibium find label "Email"` — find input by label → `@e1`
- `vibium find placeholder "Search"` — find by placeholder → `@e1`
- `vibium find testid "submit-btn"` — find by data-testid → `@e1`
- `vibium find xpath "//div[@class]"` — find by XPath → `@e1`
- `vibium find alt "Logo"` — find by alt attribute

BLOCKgrade F · trust 40/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

What the source does

Filesystem

declared (9 observation(s))

Network

declared (8 observation(s))

Shell

declared (7 observation(s))

Dependencies

not all pinned

Secrets in source

none-found

Findings (25)

({ stdout } = await exec(binary, [...flags, ...args], { env, timeout: 230000, maxBuffer: 4 * 1024 * 1024 }));

await exec(binary, ['check', '--help'], { env, timeout: 5000 });

try { await exec(binary, ['daemon', 'stop'], { env, timeout: 15000 }); }

gradle-wrapper.jar

var-parts-trace.zip

mod = __import__(mod_name, fromlist=[cls_name])

cmd.Example += example + ` --provider local --model my-model --ai-base-url http://127.0.0.1:8080/v1 --reasoning-effort ""` + "\n  # Uses these settings for one invocation; credentials still come from

baseURL = "http://127.0.0.1:8080/v1"

return "http://127.0.0.1:8080/v1"

const pTrace = pTraceFile ? parseNDJSON(join(playwrightDir, pTraceFile)) : null;

if (vTrace && pTrace) {

const pTypes = groupBy(pTrace, (e) => e.type);

const pCtxOpts = pTrace.find((e) => e.type === "context-options");

const pActions = pTrace.filter((e) => e.type === "before" || e.type === "after");

first-check-var-parts.webm

recording-sample.webm

broken.webm

.gitmodules

try { ({stdout}=await exec(bin,['--headless','--json',...args],{env,timeout:240000,maxBuffer:16*1024*1024})); }

await exec(bin,['daemon','stop'],{env,timeout:15000}).catch(()=>{});

cd ../../../clients/python && pip wheel . -w dist --no-deps

pip install -e ../../packages/python/$(PYTHON_PLATFORM_PKG) -e ".[test]"; \

$(TIMEOUT_CMD_ABS) python -m pytest ../../tests/py/ -v --tb=short -x -n $(PY_PARALLEL) --dist=loadfile \

--ignore=../../tests/py/test_browser_modes.py \

--ignore=../../tests/py/test_firefox.py

Gates applied: no_behavioural_pass.

[![ModelsAtlas audit: Vibium](https://modelsatlas.com/skills/vibiumdev/vibe-check/badge.svg)](https://modelsatlas.com/skills/vibiumdev/vibe-check/)

Not your listing, or something out of date? Claim or update your listing.