Menu
Drive an authentication flow once, sanitize cookies through AIDefence, and vault a reusable cookie handle in browser-cookies for future sessions
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
| name | browser-login |
| description | Drive an authentication flow once, sanitize cookies through AIDefence, and vault a reusable cookie handle in browser-cookies for future sessions |
| argument-hint | <login-url> [--vault-name <handle>] [--mfa] |
| allowed-tools | mcp__claude-flow__browser_open mcp__claude-flow__browser_close mcp__claude-flow__browser_fill mcp__claude-flow__browser_type mcp__claude-flow__browser_click mcp__claude-flow__browser_wait mcp__claude-flow__browser_eval mcp__claude-flow__browser_snapshot mcp__claude-flow__aidefence_scan mcp__claude-flow__aidefence_has_pii Bash Read Write |
Authenticate against a target site once, then vault the resulting session credentials so subsequent skills (browser-extract, browser-form-fill, browser-test) can reuse them without re-driving the auth flow. Borrows the pattern from Browserbase's cookie-sync/SKILL.md but stores the resulting context in AgentDB rather than on a hosted backend.
browser-record.browser_fill / browser_type. Credentials come from the user or environment; do not read them from .env or paste them into the trajectory args.--mfa): pause for user input or invoke the user's TOTP helper; capture only the resulting redirect, not the code itself.browser_eval:
document.cookie // returns the cookie string for the active document
# Each cookie value passes aidefence_scan to flag raw secrets / high-entropy tokens.
browser-cookies:
npx -y @claude-flow/cli@latest memory store --namespace browser-cookies \
--key "<host>" \
--value "{vault_handle:<opaque>, expiry:<iso>, aidefence_verdict:safe}"
browser_cookie_use MCP tool.<redacted> placeholder for values.browser_cookie_use MCP tool is reserved (ADR-0001 §7) but not yet implemented. Until then, downstream skills mount the vaulted cookies via a helper bash function in scripts/ (TBD).browser-login. Do not attempt to fingerprint-match yourself.Run one tick of the sales business-pod (ADR-164 §4.1, Phase 2). Loads templates/sales.json, validates it against the pod-schema, resolves agents against ruflo's agent registry, reserves budget via the Phase-2 file-based stub ledger (atomic SQLite tracker is Phase 3 per ADR-164.1), constructs per-agent dry-run prompts, posts a summary envelope to room "sales" via the federation_bbs_publish JSONL backing store, and emits a structured {podName, tickId, agentsRan, totalUsd, envelopeId, status} line for /loop ingestion. Dry-run by default; --live is reserved for Phase 3.
Run full security scans on the codebase using Ruflo security tools. Use when reviewing PRs for security regressions, auditing auth/input-handling code, before production deploys, or when the user asks for a security check at quick/standard/deep depth.
Initialize a multi-agent swarm with anti-drift configuration. Use when starting a complex multi-file task that needs 3+ coordinated agents (feature implementation, refactor across modules, security audit). Skip for single-file edits or quick questions.
Run the SPARC Pseudocode and Architecture phases (2 and 3) — write algorithm pseudocode, design module boundaries and API contracts, then implement
Scaffold a new Claude Code plugin with proper directory structure, plugin.json, skills, commands, and agents
Scan project dependencies for known vulnerabilities and CVEs. Use when auditing third-party packages, before releases, after `npm install`/lockfile changes, or when investigating reported CVE advisories.