skills.rest
browserbase
browserbaseOFFICIAL
Explore all skills by this author →
Website𝕏@browserbaseGitHub

safe-browser

Builds Claude Agent SDK browser agents with a CDP-enforced domain allowlist.

3.7k|237|Updated Oct 12, 2025
Search Tags:#playwright#prompt injection#CDP#Claude Agent SDK#browser agent#MCP tool#domain allowlist
One-click install
npx skills add https://github.com/browserbase/skills --skill safe-browser
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: safe-browser
Source: https://github.com/browserbase/skills/tree/main/skills/safe-browser
Command: npx skills add https://github.com/browserbase/skills --skill safe-browser

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires @anthropic-ai/claude-agent-sdk, playwright, zod.

What problem does it solve?

Giving an AI agent raw browser or shell access risks prompt-injection attacks and uncontrolled navigation to untrusted sites. This Skill generates a constrained browser agent whose only capability is a safe_browser tool that enforces a domain allowlist at the network layer via CDP Fetch interception.

Core Features & Use Cases

  • CDP-Gated Navigation: Every request passes through Fetch.requestPaused; off-allowlist hosts are blocked with Fetch.failRequest before reaching the network.
  • Constrained Tool Surface: The runtime agent gets only structured actions (goto, extract_front_page, extract_comments, current_url, audit_log) with no raw CDP passthrough or shell access.
  • Verifiable Demo: The included Hacker News template proves containment by extracting stories, visiting an internal comments page, attempting an off-domain URL, and asserting the block in an audit log.
  • Use Case: Demonstrate prompt-injection containment by letting an agent scrape Hacker News while proving it cannot follow an external link, with artifacts (audit log, tool log, screenshot) as evidence.

Quick Start

Use the safe-browser skill to build a constrained Hacker News scraping agent that stays on news.ycombinator.com and run the demo to show the blocked off-domain navigation.

Frequently Asked Questions about safe-browser

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I build a browser agent restricted to specific domains?▼

Copy the claude-agent-sdk template, install dependencies, and run the demo script. The generated agent's only tool is safe_browser, which uses CDP Fetch interception to allow allowlisted hosts and fail all other requests before they reach the network.

How does CDP Fetch interception block off-domain navigation?▼

The tool enables Fetch with a wildcard URL pattern, so every request triggers a Fetch.requestPaused event. The handler checks the hostname against the allowlist and sends Fetch.continueRequest for allowed hosts or Fetch.failRequest for blocked ones.

Can the runtime agent bypass the allowlist with raw CDP or shell access?▼

No. The agent only receives the safe_browser MCP tool with structured actions like goto and extract_front_page. There is no CDP passthrough, no shell tool, and the canUseTool callback denies every other tool.

Does safe-browser work with Browserbase remote browsers?▼

The default setup uses local Chromium launched through Playwright. Browserbase remote mode is supported only when the user explicitly requests it; otherwise the skill defaults to a local browser.

What are the requirements to run the safe-browser demo?▼

You need Node.js 18 or later, npm, a local Chromium installed via npx playwright install chromium, and an ANTHROPIC_API_KEY for the Claude Agent SDK runtime agent. Set SAFE_BROWSER_HEADLESS=false to watch the browser.

Related Skills

Explore More Software Engineering Skills→
CommandCodeAICommandCodeAI
103

playwright-skill

Automate browser testing with Playwright across Chromium, Firefox, and WebKit.

Official
Intermediate
bdgscotlandbdgscotland
30

post-news

Append news entries to site/data/news.json and deploy the site.

Community
Intermediate
vanducngvanducng
5

browser-trace

Capture read-only DevTools Protocol traces from browser automation sessions into NDJSON.

Community
Advanced
browserbasebrowserbase
3.7k

browser

Automate web browser interactions via the browse CLI.

Official
Intermediate