bb is an agentic IDE that lets users control, customize, and automate a software-development environment through a desktop app, web app, command-line interface, or HTTP API. Developers use it to run work in observable threads that can be steered or handed off to other agents. Its catalogue add-ons provide skills and instructions for working with bb.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add get-bb/bb --skill browser-automationgit clone --depth 1 https://github.com/get-bb/bbWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/get-bb/bb/browser-automation)<a href="https://agentmods.dev/skills/get-bb/bb/browser-automation"><img src="https://agentmods.dev/badge/skills/get-bb/bb/browser-automation.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00042 | $0.01014 |
| Opus 5 | $0.00021 | $0.00507 |
| Sonnet 5 | $0.00008 | $0.00203 |
| Haiku 4.5 | $0.00004 | $0.00101 |
Grade A, and why
browser-automation scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 83 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Use bb browser-automation. Open one session, retain its session ID, then inspect,
act, and verify in short scripts.
Choose --backend local --headless --machine <host-id> for headless Chrome on
an enrolled host. Choose --backend desktop --machine <host-id> --desktop <instance-id> for a new dedicated desktop automation tab. Starting desktop
control opens and focuses the browser panel; new pages created through that
controller are selected automatically. Headless sessions remain headless.
Resolve the explicit instance with bb browser instances --host <host-id> --json
first. Never silently choose a different host, mode, or login profile.
Adding --tab <tab-id> hands off an existing tab and its profile's logged-in
authority; do so only when the user asked to use that tab. The CLI uses the
current thread, or --thread <id> outside a thread. Each session belongs to
that thread.
CLI opening:
bb browser-automation open --backend local --headless --machine <host-id> --json
bb browser-automation open --backend desktop --machine <host-id> --desktop <instance-id> --json
Run scripts:
bb browser-automation run <session-id> --script 'const p = await browser.getPage("main"); await p.goto("https://example.com"); await p.snapshot()' --json
bb browser-automation run <session-id> --script 'const p = await browser.getPage("main"); await p.click("ref/e6"); await p.snapshot()' --json
bb browser-automation screenshot <session-id> --page main --json
Take a fresh snapshot before using refs after navigation or document changes.
Use refs from that session's DevBrowser snapshot. Do not mix agent-browser refs
or invent selectors. Prefer a cheap URL/text/snapshot check after each action;
request a screenshot when visual verification matters. Use
await p.shot({type:"jpeg",maxEdge:960,quality:70}); undefined inside scripts to
return a bounded JPEG file.
run and screenshot return JSON with hostId and images, where each image
has path, mimeType, width, and height. The path is in the browser session's
temporary directory on that host. Use your image-reading tool on the path when
you are on the same machine. If the browser host differs, fetch the image to
local temporary storage first (substitute the returned path and host ID):
bb file read '<image-path>' --host '<host-id>' --json | node -e '
const fs = require("node:fs"), os = require("node:os"), path = require("node:path");
const file = JSON.parse(fs.readFileSync(0, "utf8"));
if (file.contentEncoding !== "base64") throw new Error("Expected binary image");
const destination = path.join(fs.mkdtempSync(path.join(os.tmpdir(), "browser-image-")), "capture.jpg");
fs.writeFileSync(destination, Buffer.from(file.content, "base64"), {mode: 0o600});
console.log(destination);
'
Read the printed local path with your image-reading tool. Do not print base64 image bytes into the conversation. Read or copy captures before closing the session: cleanup removes its temporary directory. Remove local copies when finished.
pages lists persistent pages. Runs serialize within a session. Scripts are
trusted JavaScript with Puppeteer-style DevBrowser APIs, not a sandbox.
--script-file requires --script-host <host-id> naming the source host explicitly. Browser file
operations and localhost refer to the browser host. Transfer files explicitly.
Stop cancels running and queued work and releases desktop control. Cancellation and timeout stop the session too; open a new session to resume. Close disposes owned Chrome and plugin-created desktop tabs while preserving handed-off tabs. Close sessions after use. Five-minute idle and thirty-minute absolute expiry apply. Timeouts default to 30 seconds, maximum 120 seconds.
An unavailable backend or a failed runtime install is an actionable setup
error, not permission to attach to a random browser. The first open on a host
installs the pinned dev-browser npm release into plugin-owned host storage
there and verifies its provenance and digest; it needs npm, network access, and
Chrome on that host, and can take a minute. Later opens reuse the verified
install offline. The exact pin and Chrome setup are documented in the plugin
README. Cloud browsers and arbitrary CDP endpoints are unsupported.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 83 lines · 42 tokens per session scan A 01e53c0c8771
browser-automation is a skill published in the GitHub repository get-bb/bb (3,416 stars, last pushed today), licensed MIT. It adds 42 tokens to every session and 1,014 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-07.
Other skills, from other repositories
cradle-plugin-browser-use
Control Cradle's in-app browser via MCP tools. Use when the Claude Agent needs to navigate websites, click elements, type text, take screenshots, read page content, or inspect DOM structure within the Cradle desktop app's embedded browser panel. Triggers on "open URL", "navigate to", "click the button", "fill the…
d3k
Use when the user asks to use d3k, run/dev/test/debug a web project with d3k, or reproduce a browser issue. Own the runtime: reuse or background-start d3k non-interactively, wait for readiness, use its project-stable managed Chrome profile, and inspect unified browser/server evidence.
surf
Control Chrome browser via CLI for testing, automation, and debugging. Use when the user needs browser automation, screenshots, form filling, page inspection, network/CPU emulation, DevTools streaming, or AI queries via ChatGPT/Gemini/Perplexity/Grok/AI Studio.
javascript-sandbox
Best practices for using the stagewise built-in JavaScript sandbox. Explains how to access APIs for browser debugging/interaction, use external dependencies, file system access, running mini-apps, etc.
devloop
Drive Devloop — browser + dev-server on one correlated timeline (web, plus native iOS/Android Expo apps) — by calling its MCP tools as shell commands via mcporter. Use when Devloop's MCP server isn't wired into this agent directly (e.g. a sandboxed or enterprise setup that blocks MCP) but you can run shell commands.
playwriter
A command-line tool for controlling the user's currently open Chrome tab through Playwriter. It can inspect the page, perform browser actions, and collect console output.