browser-login

Estrelas66.991

Forks7.995

Atualizado17 de julho de 2026 às 03:06

Drive an authentication flow once, sanitize cookies through AIDefence, and vault a reusable cookie handle in browser-cookies for future sessions

Instalação

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Fonte

ruvnet

ruvnet/ruflo

Abrir repositório GitHub Ver repositórios do creator

Download

Ocupações relacionadasSOC

Baseado na classificação ocupacional SOC

Desenvolvedores de softwareInformática e Matemática·SOC 15-1252

SKILL.md

readonly

name	browser-login
description	Drive an authentication flow once, sanitize cookies through AIDefence, and vault a reusable cookie handle in browser-cookies for future sessions
argument-hint	<login-url> [--vault-name <handle>] [--mfa]
allowed-tools	mcp__plugin_ruflo-core_ruflo__browser_open mcp__plugin_ruflo-core_ruflo__browser_close mcp__plugin_ruflo-core_ruflo__browser_fill mcp__plugin_ruflo-core_ruflo__browser_type mcp__plugin_ruflo-core_ruflo__browser_click mcp__plugin_ruflo-core_ruflo__browser_wait mcp__plugin_ruflo-core_ruflo__browser_eval mcp__plugin_ruflo-core_ruflo__browser_snapshot mcp__plugin_ruflo-core_ruflo__aidefence_scan mcp__plugin_ruflo-core_ruflo__aidefence_has_pii Bash Read Write

Browser Login

Authenticate against a target site once, then vault the resulting session credentials so subsequent skills (browser-extract, browser-form-fill, browser-test) can reuse them without re-driving the auth flow. Borrows the pattern from Browserbase's cookie-sync/SKILL.md but stores the resulting context in AgentDB rather than on a hosted backend.

When to use

Establishing reusable auth for a host the agent will visit repeatedly.
Refreshing a vaulted cookie set whose expiry has passed.
Capturing an MFA-protected session that requires interactive completion.

Steps

Open a recorded session via browser-record.
Drive the auth flow — fill credentials with browser_fill / browser_type. Credentials come from the user or environment; do not read them from .env or paste them into the trajectory args.
Handle MFA (when --mfa): pause for user input or invoke the user's TOTP helper; capture only the resulting redirect, not the code itself.
Capture cookies via browser_eval:
```
document.cookie  // returns the cookie string for the active document
```
Or use the Playwright context API where exposed.
AIDefence sanitize:
```
# Each cookie value passes aidefence_scan to flag raw secrets / high-entropy tokens.
```
Tokens that look raw get vault-wrapped (an opaque handle) before AgentDB store; raw values never enter the namespace.

Store in browser-cookies:

npx -y @claude-flow/cli@latest memory store --namespace browser-cookies \
  --key "<host>" \
  --value "{vault_handle:<opaque>, expiry:<iso>, aidefence_verdict:safe}"

Return the vault handle so downstream skills can mount it via the planned browser_cookie_use MCP tool.

Caveats

Never log raw cookie values, tokens, or passwords. The trajectory step for the auth POST records only the form field names and a <redacted> placeholder for values.
The browser_cookie_use MCP tool is reserved (ADR-0001 §7) but not yet implemented. Until then, downstream skills mount the vaulted cookies via a helper bash function in scripts/ (TBD).
Some sites bind cookies to a UA fingerprint; if a vaulted cookie fails on reuse, re-run browser-login. Do not attempt to fingerprint-match yourself.
This skill is not a credential storage solution. The vault-handle pattern protects against AgentDB leaks, not against compromise of the agent's environment.

Mais deste repositório

mesmo repositório

ruflo

ruvnet/ruflo

Ruflo is a multi-agent orchestration platform for AI coding agents (Claude Code, Cursor, Codex, Copilot, Gemini, Amp, +12 more). Use this skill when the user wants to (1) install/init ruflo in a project, (2) run multi-agent swarms with hierarchical coordination, (3) use ruflo's 314+ MCP tools for memory, routing, hooks, sub-agents, or workflows, (4) check ruflo status/version/doctor health, or (5) discover which of ruflo's 30+ plugins fits their task.

2026-08-0467.0k

agntcy-status

ruvnet/ruflo

Show AGNTCY/SLIM/CASA integration status — whether upstream AGNTCY packages are installed, which transport (local vs SLIM) is active, and whether CASA enforcement is enabled. Use when the user asks "is AGNTCY configured?", "show SLIM/CASA status", or "is AGNTCY/IOC integration active?".

2026-07-3167.0k

adr-create

ruvnet/ruflo

Create a new Architecture Decision Record with sequential numbering and AgentDB registration

2026-07-2967.0k

adr-index

ruvnet/ruflo

Build or rebuild the ADR index + dependency graph by running scripts/import.mjs (handles v3-style and plugin-style ADR formats; one Bash call vs hundreds of MCP round-trips)

2026-07-2967.0k

harness-genome

ruvnet/ruflo

7-section repo readiness report from `metaharness genome <path>`. Returns repo_type / agent_topology / risk_score / mcp_surface / test_confidence / publish_readiness. Pure-read; degrades gracefully (ADR-150).

2026-07-2967.0k

ruflo-status

ruvnet/ruflo

Diagnose Ruflo health, then report system, MCP server, and active-agent status without changing the installation

2026-07-2967.0k

Browser Login

When to use

Establishing reusable auth for a host the agent will visit repeatedly.

Refreshing a vaulted cookie set whose expiry has passed.

Capturing an MFA-protected session that requires interactive completion.

Steps

Open a recorded session via browser-record.

Drive the auth flow — fill credentials with browser_fill / browser_type. Credentials come from the user or environment; do not read them from .env or paste them into the trajectory args.

Handle MFA (when --mfa): pause for user input or invoke the user's TOTP helper; capture only the resulting redirect, not the code itself.

Capture cookies via browser_eval:

document.cookie  // returns the cookie string for the active document

Or use the Playwright context API where exposed.

AIDefence sanitize:

# Each cookie value passes aidefence_scan to flag raw secrets / high-entropy tokens.

Tokens that look raw get vault-wrapped (an opaque handle) before AgentDB store; raw values never enter the namespace.

Store in browser-cookies:

npx -y @claude-flow/cli@latest memory store --namespace browser-cookies \
  --key "<host>" \
  --value "{vault_handle:<opaque>, expiry:<iso>, aidefence_verdict:safe}"

Return the vault handle so downstream skills can mount it via the planned browser_cookie_use MCP tool.

Caveats

Never log raw cookie values, tokens, or passwords. The trajectory step for the auth POST records only the form field names and a <redacted> placeholder for values.

The browser_cookie_use MCP tool is reserved (ADR-0001 §7) but not yet implemented. Until then, downstream skills mount the vaulted cookies via a helper bash function in scripts/ (TBD).

Some sites bind cookies to a UA fingerprint; if a vaulted cookie fails on reuse, re-run browser-login. Do not attempt to fingerprint-match yourself.

This skill is not a credential storage solution. The vault-handle pattern protects against AgentDB leaks, not against compromise of the agent's environment.