Browser4 is an AI-native browser engine that lets autonomous agents and people control real browsers, extract information from web pages, and automate tasks at scale. It combines browser interaction through a Rust CLI and MCP with deterministic selectors, machine-learning clustering, and language-model extraction. The catalogue entries provide skills and instructions for using Browser4.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add platonai/Browser4 --skill browser4-cligit clone --depth 1 https://github.com/platonai/Browser4Wrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/platonai/browser4/browser4-cli)<a href="https://agentmods.dev/skills/platonai/browser4/browser4-cli"><img src="https://agentmods.dev/badge/skills/platonai/browser4/browser4-cli/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/platonai/browser4/browser4-cli"><img src="https://agentmods.dev/badge/skills/platonai/browser4/browser4-cli.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 162 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high YARA Match · line 162 YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).Fix: Remove the malware payload or compromised file entirely. Investigate how it entered the skill and audit all other artifacts for additional indicators of compromise.
- medium Rogue Agent · line 215 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 215 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00052 | $0.14755 |
| Opus 5.5 | $0.00021 | $0.05902 |
| Sonnet 5.5 | $0.00010 | $0.02951 |
| Haiku 4.5 | $0.00005 | $0.01476 |
Grade E, and why
browser4-cli scanned grade E with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -fsSL https://browser4.oss-cn-beijing.aliyuncs.com/scripts/install-browser4-cli.sh | bash # Linux/macOS Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
> `rm -rf ./downloads && mkdir -p ./downloads` or delete the old files first. Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -fsSL https://browser4.oss-cn-beijing.aliyuncs.com/scripts/install-browser4-cli.sh | bash # Linux/macOS How it starts
The opening of the file, as written. The whole thing — 495 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Browser Automation with browser4-cli
Browser automation CLI for AI agents — Chrome/Chromium via CDP with accessibility-tree snapshots.
This is the decision layer: the core loop, the command map, and which reference to open. Every topic links to a deep dive — load only what the task needs (§7 Reference Map).
Invocation
After installing (browser4-cli install), invoke commands directly — the docs use browser4-cli as the generic command name:
browser4-cli open --headless <url>
Windows / Git Bash (MSYS) users. From Git Bash (or any MSYS2 shell), arguments starting with
/are rewritten into Windows paths before PowerShell starts, so./b4w.ps1refuses them (the original value is unrecoverable). Invoke./b4w.sh <command>, or prefixMSYS2_ARG_CONV_EXCL='*' ./b4w.ps1 <command>. Where the value is a substring/regex rather than an exact path, drop the leading slash —-olp "product/"still matches/product/…hrefs — andcookie-set --pathalready defaults to/, so the flag can be omitted entirely — for example./b4w.sh crawl "<url>" -d 2 -ol "a.product" -olp "product/". The same rewrite hits--path /,pushstate "/route"and the--path=/spelling — see shell-quoting.md.
1. Core Loop
⚡ First-run latency: From a source tree, the first launch builds the runtime bundle via Maven (~1–3 min, before the spinner appears) and then starts the Browser4 backend (Spring Boot + JVM, ~10s). Subsequent commands are instant — the server stays alive between invocations.
🖥️ Headless mode is the default for AI agents: Always open browsers with
--headlessunless the user explicitly asks to see the browser window ("show me the browser", "open visibly", "I want to watch", or "headed"), a human must act on the page, or the site blocked the headless browser — in that last case retry--headedonce (§2 Display Mode).
🛑 Dev mode never serves a stale backend. From a source tree the backend must be the checked-out code. An already assembled runtime bundle is reused as-is while it matches the checkout. If it was built from a different project version, the command fails with a non-zero exit and names the reason, the bundled/checked-out versions, the bundle's build time and the rebuild command — nothing is started. If the checkout's sources merely look newer than the bundle jars, the command rebuilds from source and then starts (that signal cannot tell a real source change from a touched-but-unchanged tree, so refusing on it would block startup on a false positive). Rebuild with
powershell -ExecutionPolicy Bypass -File browser4-apps/browser4-bundle/build-runtime-bundle.ps1(pwsh -File …on Linux/macOS) or re-run withBROWSER4_CLI_FORCE_REBUILD_BUNDLE=1. To deliberately test the older backend, set the single opt-outBROWSER4_CLI_ALLOW_STALE_BUNDLE=1— the warning stays, andstatus/doctorkeep reporting the skew (local_bundlein--json).
What ships with it
42 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- methodology.md 14 KB
- references/agent.md 12 KB
- references/attach.md 24 KB
- references/browser-modes.md 34 KB
- references/browser-state-import.md 8.7 KB
- references/config.md 4.5 KB
- references/crawl.md 34 KB
- references/css-selector-bridge.md 12 KB
- references/decision-trees.md 13 KB
- references/development-mode.md 5.4 KB
- references/eval.md 10 KB
- references/frames.md 6.9 KB
- references/htmlsnapshot-scenarios-advanced.md 14 KB
- references/htmlsnapshot-scenarios-amazon.md 26 KB
- references/htmlsnapshot-scenarios-audit.md 18 KB
- references/htmlsnapshot-scenarios-extraction.md 14 KB
- references/htmlsnapshot-scenarios.md 8.0 KB
- references/htmlsnapshot.md 46 KB
- references/load-options-decision.md 4.4 KB
- references/load-options-guide.md 14 KB
- references/loop.md 15 KB
- references/network.md 15 KB
- references/plugins.md 11 KB
- references/power-dom.md 7.3 KB
- references/quick-patterns.md 16 KB
- references/quickstart.md 9.1 KB
- references/scrape-formats.md 15 KB
- references/shell-quoting.md 9.2 KB
- references/skills.md 9.1 KB
- references/snapshot.md 22 KB
- references/storage-state.md 7.4 KB
- references/swarm.md 22 KB
- references/tab-management.md 5.9 KB
- references/tabs.md 7.4 KB
- references/upload.md 5.5 KB
- references/webdb.md 8.0 KB
- references/x-sql-array-functions.md 4.7 KB
- references/x-sql-dom-functions.md 16 KB
- references/x-sql-dom-load-select.md 3.3 KB
- references/x-sql-dom-select-functions.md 11 KB
- references/x-sql-string-functions.md 16 KB
- references/x-sql.md 29 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +86 lines scan C → E 1f4120e9a412
- 4d ago Changed · +2 lines 2526d9be6057
- 6d ago Changed · +21 lines ecbea6ecbc91
- 15d ago Changed · +17 lines 549277d9a677
- 24d ago Changed · +71 lines 7a08f4d141be
- 1mo ago Changed · +5 lines scan A → C 0c2ab79159aa
- 1mo ago Changed · +2 lines edb199324e34
- 1mo ago First seen · 291 lines · 52 tokens per session scan A f551d7b3c9d4
browser4-cli is a skill published in the GitHub repository platonai/Browser4 (1,161 stars, last pushed yesterday), licensed Apache-2.0. It adds 52 tokens to every session and 14,755 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it E with 3 findings (downloads and executes remote code, recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
e2e-testing-patterns
Master end-to-end testing with Playwright and Cypress to build reliable test suites that catch bugs, improve confidence, and enable fast deployment. Use when implementing E2E tests, debugging flaky tests, or establishing testing standards.
browser-testing-with-screenshots
Use when testing web applications with visual verification - automates Chrome browser interactions, element selection, and screenshot capture for confirming UI functionality.
BrowserBash Browser Automation
BrowserBash is a vendor-independent, natural-language browser automation CLI. Drive a real browser from plain-English objectives or committable Markdown tests, run on local Chrome, CDP/Playwright MCP, Browserbase, LambdaTest, or BrowserStack, and stream NDJSON results with CI exit codes — using free local Ollama…
run-dashboard-e2e-local-changes
Run Playwright E2E (tests/e2e/) against the docker/ all-in-one harness so it reflects LOCAL code changes, not a stale cached image.
qa-testing-playwright
Builds and debugs Playwright E2E suites. Use when authoring browser tests, fixing flakes, or hardening Playwright CI and locator strategy.
qa-persona-testing
Tests apps as an ICP persona through browser automation and reports friction, fixes, and risks. Use when running persona-based, ICP, or synthetic-user testing.