browser-automation_skill

Overview

This skill provides expert browser automation using Chrome DevTools Protocol and WebDriver with a security-first posture. It focuses on secure web automation, test-driven development (TDD), performance optimization, and strict credential and domain protections. The implementation emphasizes audit logging, rate limiting, and safe defaults for scraping and testing workflows.

How this skill works

The automation validates every URL against domain allowlists and blocked patterns before navigation, intercepts and filters network requests, and applies resource blocking to speed runs. It exposes primitives for secure navigation, safe element interaction (blocking password fields), rate limiting, and session management with isolated browser contexts and cleanup. Auditing hooks log actions while redacting sensitive values.

When to use it

• Automated testing where domains and credentials must be tightly controlled
• Web scraping tasks that require high performance while avoiding tracking and sensitive sites
• Reusable browsing sessions for parallel tests or large-scale scraping with context reuse
• Security-sensitive automation workflows requiring audit trails and rate limits
• Prototyping interactions that must never expose or store user credentials

Best practices

• Start with failing tests (TDD) that assert security and rate limits before implementation
• Enforce a domain allowlist and explicit URL validation for every navigation
• Never store or log raw credentials; redact sensitive data in audit logs
• Reuse browser contexts for performance and create fresh contexts per test for isolation
• Block images, fonts, analytics, and other unnecessary resources to speed execution
• Apply rate limiting and timeouts on all operations and fail fast on suspicious access

Example use cases

• CI test suites using pytest-playwright that must block banking and login pages
• Scraping public product pages in parallel while blocking analytics and heavy assets
• Running security-focused smoke tests that assert password fields are never filled
• Automated data collection with auditable navigation records compliant with policy
• Shared browser session patterns for endpoint testing with per-test context isolation