browser-cdp

browser-cdp is a skill for Claude Code from zenstory-ai/oh-story-claudecode. It costs 94 tokens per session (2,056 once invoked), scanned A, original, MIT.

A browser-control tool for Chrome that uses Chrome DevTools Protocol (CDP), the built-in interface for inspecting and controlling a browser. It can reuse an existing Chrome login session for automated tasks.

In plain words
What is it for?
Opening pages, waiting for them to load, running JavaScript in the browser, taking page snapshots, and extracting authentication tokens.
Why use it?
It avoids signing in again when automation needs access to an account. It also provides a defined startup process because enabling control may close a regular Chrome session and lose unsaved work.

Skill for Claude Code

Written for Claude Code: shipped in a Claude Code plugin. Also seen: names the AskUserQuestion tool; built for openclaw; mentions OpenCode.

Part of the oh-story plugin — 13 skills, 13 commands shipped together

not rated 6.8krepo +249 today A scan Socket: warnSnyk: failSkillSpector: pass 94 tokens original MIT

Good fit Opening pages, waiting for them to load, running JavaScript in the browser, taking page snapshots, and extracting authentication tokens.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/zenstory-ai/oh-story-claudecode/browser-cdp
About the project

oh-story-claudecode is a skill package for planning, analyzing, and writing Chinese web fiction, covering both short and long novels. It is intended for writers using Claude Code, Codex, OpenClaw, and other supported AI-agent environments, with workflows for market research, story breakdowns, drafting, editing, and cover creation. The catalogue entries are the package's skills, commands, agents, and plugin.

zenstory-ai/oh-story-claudecode · 6,780 stars · on GitHub · zenstory.ai

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add zenstory-ai/oh-story-claudecode --skill browser-cdp
Clone the repo
git clone --depth 1 https://github.com/zenstory-ai/oh-story-claudecode

Made for: Claude Code.

Or install oh-story, the plugin that ships this one along with the rest of its 13 skills, 13 commands.

Its marketplace also offers this one on its own, as the plugin browser-cdp/plugin install browser-cdp after adding the marketplace above.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for browser-cdp

README.md
[![agentmods](https://agentmods.dev/badge/skills/zenstory-ai/oh-story-claudecode/browser-cdp/github.svg)](https://agentmods.dev/skills/zenstory-ai/oh-story-claudecode/browser-cdp)
Your own site
<a href="https://agentmods.dev/skills/zenstory-ai/oh-story-claudecode/browser-cdp"><img src="https://agentmods.dev/badge/skills/zenstory-ai/oh-story-claudecode/browser-cdp/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for browser-cdp

Your own site · 80×15
<a href="https://agentmods.dev/skills/zenstory-ai/oh-story-claudecode/browser-cdp"><img src="https://agentmods.dev/badge/skills/zenstory-ai/oh-story-claudecode/browser-cdp.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 94 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,056 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • Socket warn 24 Aug 2026
  • Snyk fail 24 Aug 2026
  • NVIDIA SkillSpector pass 7 Sept 2026
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00094 $0.02056
Opus 5 $0.00047 $0.01028
Sonnet 5 $0.00019 $0.00411
Haiku 4.5 $0.00009 $0.00206

Measured 13d ago against content hash aa594fbec8ba, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-12, from the pricing page.

Security

Grade A, and why

browser-cdp scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 13d ago.

The scan reads SKILL.md. This mod also ships 1 executable file (scripts/setup-cdp-chrome.js), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

Copies of this mod

1 near-identical copy found in the catalogue:

skills/browser-cdp/SKILL.md · 176 lines

How it starts

The opening of the file, as written. The whole thing — 176 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Browser CDP 操作工具

通过 CDP 协议控制 Chrome,复用已有登录态,执行浏览器自动化操作。

前置条件

  • macOS / Linux / Windows(实验性),已安装 Google Chrome
  • Node.js 20+
  • agent-browser 已安装:npm install -g agent-browser

⚠️ 首次启动会 kill 用户的常规 Chrome。 在启动前必须征求用户同意(见下方"启动流程"),否则用户可能丢失未保存的标签页/草稿。


启动流程(skill-mode 强制步骤)

第一步:探测当前状态(无副作用)

node {SKILL_DIR}/scripts/setup-cdp-chrome.js 9222 --detect-only

输出形如:

CDP_STATUS=ready                        # 已就绪,可直接复用
CDP_URL=http://127.0.0.1:9222/json/version
BROWSER=Chrome/148.0.7778.168

或:

CDP_STATUS=needs-setup
CHROME_RUNNING=yes                      # 用户有 Chrome 在跑,启动会杀掉
CHROME_PID_COUNT=3

第二步:根据探测结果分支

  • CDP_STATUS=ready → 直接使用 agent-browser --cdp 9222 ...不要运行 setup
  • CDP_STATUS=needs-setupCHROME_RUNNING=no → 安全启动:
    node {SKILL_DIR}/scripts/setup-cdp-chrome.js 9222 --yes
    
  • CDP_STATUS=needs-setupCHROME_RUNNING=yes先用 AskUserQuestion 工具向用户确认:告知会杀掉 N 个 Chrome 进程、可能丢失未保存工作;用户同意后再带 --yes 启动;用户拒绝则放弃这次自动化。

为什么不能直接 --yes 脚本在非 TTY(即 skill 模式 / Bash 工具)下,如果检测到 Chrome 在跑而没有 --yes,会以退出码 3 报 NEEDS_CONSENT: ... 并中止,不会静默杀进程。这是有意的兜底——但 skill 流程仍应先问用户,而不是看到 3 就盲传 --yes


启动脚本选项

选项 说明
--detect-only 只探测,不修改任何状态(skill 用)
--yes 已征得同意,跳过交互提示
--reset 启动前清空 ~/chrome-debug-profile(登录失效时用)
--profile <name> 使用非 Default 的 Chrome profile(如 "Profile 1"
--dry-run 打印将执行的步骤,不执行

退出码:0 成功 / 1 通用错误 / 2 用户拒绝(TTY)/ 3 需同意但缺 --yes


常用操作

打开页面并等待加载

agent-browser --cdp 9222 open "<URL>"
agent-browser --cdp 9222 wait 3000

提取页面文本

agent-browser --cdp 9222 eval 'document.body.innerText.substring(0, 8000)'

提取 Auth Token

agent-browser --cdp 9222 eval 'localStorage.getItem("token") || document.cookie'

复杂 JS(含引号 / $ / 反引号)

shell 转义容易出错,用以下两种方式之一:

# 1) base64 包裹
agent-browser --cdp 9222 eval -b "$(echo -n "document.querySelectorAll('a').length" | base64)"

# 2) heredoc + --stdin
cat <<'EOF' | agent-browser --cdp 9222 eval --stdin
const links = document.querySelectorAll('a');
links.length;
EOF

Read the full file on GitHub · 176 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 13d ago First seen · 176 lines · 94 tokens per session scan A aa594fbec8ba

Subscribe to this mod's changes

browser-cdp is a skill published in the GitHub repository zenstory-ai/oh-story-claudecode (6,780 stars, last pushed today), licensed MIT. It adds 94 tokens to every session and 2,056 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.