Menu
Human-like mouse, keyboard and scroll behavior for behavioral bot bypass.
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/uphiago/recon-skills --skill humanize-automationThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Showing SKILL.md
Full WSTG-aligned web application pentest — 12-phase methodology from information gathering through reporting, with concrete commands, expected outputs, pitfalls, and verification per phase.
Attack SAML SSO via XSW, signature strip, metadata extract.
Use when two or more verified findings may combine into a higher-impact authorized attack path.
Based on SOC occupation classification
| name | humanize-automation |
| description | Human-like mouse, keyboard and scroll behavior for behavioral bot bypass. |
| version | 1.1.0 |
| revision_date | "2026-07-25T00:00:00.000Z" |
| license | MIT |
| platforms | ["linux"] |
| compatibility | Requires python3 |
| tags | ["recon","humanize","behavioral","anti-bot","mouse","keyboard","automation"] |
| category | recon |
| related_skills | ["stealth-browser-launch","tls-fingerprint-impersonation"] |
Replace instant programmatic interactions with human-like mouse movements, keyboard typing, and scroll patterns. Patches Playwright's API at the class level — page.click(), page.type(), page.fill(), and Locator methods are automatically replaced with Bézier-curved mouse paths, per-character typing with mistypes, and multi-phase scroll acceleration. One flag (humanize=True) enables all behavioral patches. No code changes required.
requestAnimationFrame-based mouse movement tracking.terminal with python3.cloakbrowser installed: pip install cloakbrowser.patch_page from the humanize module.from cloakbrowser import launch
browser = launch(humanize=True)
page = browser.new_page()
page.goto("https://target.com/login")
# All interactions are automatically humanized
page.locator("#email").fill("user@example.com") # per-character timing
page.locator("#password").fill("password123") # with thinking pauses
page.locator("button[type=submit]").click() # Bézier curve movement
browser.close()
One flag enables all behavior patches:
browser = launch(
headless=False,
proxy="http://residential-proxy:port",
geoip=True,
humanize=True,
)
page = browser.new_page()
page.goto()
page.locator().fill()
page.locator().click()
For sites that profile interaction speed:
browser = launch(
humanize=True,
human_preset="careful", # slower typing, more idle pauses
)
Careful preset changes: typing 100±50ms (vs 70±40ms), click aim 80-180ms (vs 60-140ms), idle_between_actions enabled with 0.4-1.0s pauses.
Override individual parameters for site-specific tuning:
from cloakbrowser import HumanConfig
custom = HumanConfig(
typing_delay=150,
typing_delay_spread=60,
typing_pause_chance=0.15,
mistype_chance=0.03,
mouse_wobble_max=2.0,
click_aim_delay_input=(100, 200),
scroll_delta_base=(60, 100),
idle_between_actions=True,
idle_between_duration=(0.5, 1.5),
)
browser = launch(humanize=True, human_config=custom)
Override behavior for individual interactions:
# Slow, careful typing for password field
page.locator("#password").fill("secret", human_config={"typing_delay": 200})
# Fast click (bypass aim delay)
page.locator("#submit").click(human_config={"click_aim_delay_input": (0, 0)})
Patch an existing Playwright page:
from playwright.sync_api import sync_playwright
from cloakbrowser.human import patch_page, resolve_config
pw = sync_playwright().start()
browser = pw.chromium.launch()
page = browser.new_page()
# Apply humanization to an existing page
config = resolve_config("default")
patch_page(page, config)
# All interactions now humanized
page.locator("#email").fill("user@example.com")
| Parameter | Default | Effect |
|---|---|---|
mouse_steps_divisor | 8 | Controls smoothness (lower = smoother, more steps) |
mouse_min_steps | 25 | Minimum steps per movement |
mouse_max_steps | 80 | Maximum steps per movement |
mouse_wobble_max | 1.5 px | Sideways sinusoidal wobble amplitude |
mouse_overshoot_chance | 0.15 | Probability of overshooting target |
mouse_overshoot_px | (3, 6) px | Overshoot distance |
Movement algorithm: Cubic Bézier curve with 2 random perpendicular control points → ease-in-out cubic easing → sinusoidal wobble → 15% overshoot chance with correction.
| Parameter | Default | Effect |
|---|---|---|
typing_delay | 70 ms | Average per-character delay |
typing_delay_spread | 40 ms | Random spread around delay |
typing_pause_chance | 0.10 | Thinking pause probability per character |
typing_pause_range | (400, 1000) ms | Thinking pause duration |
mistype_chance | 0.02 | Typo probability per character |
mistype_delay_notice | (100, 300) ms | Time before noticing typo |
mistype_delay_correct | (50, 150) ms | Time to correct typo |
field_switch_delay | (800, 1500) ms | Delay when switching between form fields |
Typing algorithm: Per-character delay with random spread → 10% pause chance → 2% typo chance (nearby key → notice → backspace → retype) → Shift symbols via CDP Input.dispatchKeyEvent for isTrusted=true.
| Parameter | Default | Effect |
|---|---|---|
scroll_delta_base | (80, 130) px | Scroll distance per step |
scroll_accel_steps | (2, 3) | Acceleration phase steps |
scroll_decel_steps | (2, 3) | Deceleration phase steps |
scroll_overshoot_chance | 0.10 | Probability of overshooting |
scroll_overshoot_px | (50, 150) px | Overshoot distance |
scroll_target_zone | (0.20, 0.80) | Target zone in viewport |
scroll_settle_delay | (300, 600) ms | Delay after reaching target |
Scroll algorithm: Accelerate (2-3 steps, 80-100px) → cruise (80-130px, burst into 20-40px wheel chunks at 8-20ms intervals) → decelerate (2-3 steps, 60-90px) → 10% overshoot chance with correction.
| Parameter | Default | Effect |
|---|---|---|
click_aim_delay_input | (60, 140) ms | Delay before clicking input elements |
click_aim_delay_button | (80, 200) ms | Delay before clicking buttons |
click_hold_input | (40, 100) ms | Hold duration on inputs |
click_hold_button | (60, 150) ms | Hold duration on buttons |
click_input_x_range | (0.05, 0.30) | Click position within input (left side) |
| Parameter | Default | Effect |
|---|---|---|
idle_between_actions | False | Enable micro-movements between actions |
idle_between_duration | (0.3, 0.8) sec | Idle duration between actions |
idle_drift_px | 3 px | Random cursor drift during idle |
idle_pause_range | (300, 1000) ms | Idle pause duration |
initial_cursor_x | (400, 700) px | Starting cursor X (address bar area) |
initial_cursor_y | (45, 60) px | Starting cursor Y (address bar area) |
| Preset | Typing | Aim Delay | Idle Between | Use Case |
|---|---|---|---|---|
default | 70±40ms | 60-140ms | No | Normal human speed |
careful | 100±50ms | 80-180ms | Yes (0.4-1.0s) | Slower, more deliberate |
page.click(selector) or page.locator(selector).* — avoid query_selector() handles.page.fill() with humanize clears existing content and types character by character. This is intentional but slower than raw fill().careful preset or increase typing_delay for suspicious targets.https://deviceandbrowserinfo.com — should show 24/24 behavioral signals passed.humanize=True — humanize should increase score by 0.2-0.4.Input.dispatchKeyEvent events have isTrusted: true in the event listener.stealth-browser-launch — Launch the patched Chromium binary with C++ fingerprint modifications.tls-fingerprint-impersonation — TLS/JA4 fingerprint spoofing for HTTP-level evasion.