kesslerio-stealth-browser_skill

Overview

This skill provides anti-bot browser automation using Camoufox and curl_cffi to bypass aggressive fingerprinting and challenges like Cloudflare Turnstile and Datadome. It focuses on practical, reproducible patterns for scraping and session management when standard Playwright or Selenium is blocked. The tools run inside an isolated pybox environment and emphasize correct Python versioning and proxy selection.

How this skill works

Camoufox is a patched Firefox fork with low-level stealth patches that mimics real browser fingerprints and handles mouse/timing behavior to pass Turnstile and similar checks. curl_cffi is a TLS-fingerprinting HTTP client for API-only endpoints where JavaScript execution is not required. Scripts orchestrate profile-based sessions, proxy configuration, and behavioral actions (warm-up, mouse movements, randomized delays) to reduce detection.

When to use it

• Standard Playwright or Selenium sessions are consistently blocked or show browser checks
• The site presents Cloudflare Turnstile, Datadome, or other anti-bot challenges
• You need to scrape protected sites like Airbnb, Yelp, or similar platforms
• You require persistent authenticated sessions that survive headless checks
• You want a lightweight API-only approach for known endpoints without JS execution

Best practices

• Always use residential or mobile proxies; datacenter IPs are frequently blocked on Airbnb/Yelp
• Run tools inside pybox and invoke Python explicitly as python3.14 to avoid version mismatches
• Warm up sessions by visiting the homepage and interacting before targeting sensitive pages
• Keep session stickiness: reuse the same proxy IP for 10–30 minute sessions and avoid per-request rotation
• Avoid predictable timing and add randomized delays (e.g., 2–5s) and natural mouse movements

Example use cases

• Interactively log in with a headed Camoufox session, save the profile, and reuse headless sessions later
• Fetch a protected Airbnb listing HTML or screenshot with Camoufox and a residential proxy
• Query an API endpoint using curl_cffi with TLS spoofing for mobile app reverse-engineered calls
• Automate periodic checks of business pages on Yelp while preserving session cookies and proxy stickiness
• Recover from login walls by detecting status/title/content signals and triggering an interactive re-login