# Kasm Browser

> Drive a persistent interactive browser via Chrome DevTools Protocol (KASM Chrome)

- **Type:** Skill
- **Install:** `agentstack add skill-mrtrenchtrucker-contak-browser-skills-kasm-browser`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [MrTrenchTrucker](https://agentstack.voostack.com/s/mrtrenchtrucker)
- **Installs:** 0
- **Category:** [Web & Browser](https://agentstack.voostack.com/c/web-and-browser)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [MrTrenchTrucker](https://github.com/MrTrenchTrucker)
- **Source:** https://github.com/MrTrenchTrucker/contak-browser-skills/tree/main/skills/kasm-browser

## Install

```sh
agentstack add skill-mrtrenchtrucker-contak-browser-skills-kasm-browser
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# KASM Browser via CDP

When invoked, drive a persistent KASM Chrome browser using Chrome DevTools Protocol. Use this when a flow needs login state, cookies that persist, captcha/2FA, or React-style synthetic events.

## Inputs
- `action` -- one of: `navigate`, `click`, `type`, `screenshot`, `close_tab`, `eval`
- `url` -- target URL (for `navigate`)
- `selector` -- CSS selector (for `click`, `type`)
- `text` -- text to type (for `type`)
- `tab_id` -- existing tab to target (optional; otherwise pick or create)
- `output_path` -- for `screenshot` action, where to save the PNG

## Output
- `screenshot` action: file path to PNG.
- Other actions: status + DOM snapshot or evaluated value.

## Steps
1. Confirm CDP reachable: `docker exec  curl -s http://localhost:9222/json/version`.
2. List tabs: `docker exec  curl -s http://localhost:9222/json`.
3. Pick or create the target tab; capture its `webSocketDebuggerUrl`.
4. Open a WebSocket to that URL from inside the container.
5. Send the CDP commands for the action, applying the **Human-Speed Rule** between every meaningful step.
6. Capture results (DOM, screenshot, console output).
7. Close the WebSocket; tidy up any tabs your flow created.

## The Human-Speed Rule (mandatory)
**Slow IS fast.**

- Minimum **1.5-3 seconds** between meaningful actions.
- Typing: one key at a time, **80-150 ms between keystrokes** with jitter. Do NOT blast a full string via `input.value = "..."` on sites that profile typing cadence.
- Wait for `Page.loadEventFired` before queuing a second navigation.
- Self-imposed rate limit: ~20 CDP calls per 10 seconds.

Bot-detection systems flag burst patterns even when intent is benign. Human-speed pacing is free immunity. Apply regardless of how impatient the user is.

## Example: navigate + read title
```javascript
const sock = new ws(tab.webSocketDebuggerUrl);
// ... open WS, set up send() helper ...
await send("Page.navigate", { url: "https://example.com" });
await new Promise(r => setTimeout(r, 3000));   // human-speed wait
const title = (await send("Runtime.evaluate", { expression: "document.title" })).result.result.value;
```

## Notes
- CDP is reachable only from inside the container -- always go via `docker exec`.
- For full setup, cross-host usage, common recipes, and troubleshooting, see `sops/SOP_Interactive_Browser_via_KASM_CDP.md`.
- Always check the target site's Terms of Service before automating against it.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [MrTrenchTrucker](https://github.com/MrTrenchTrucker)
- **Source:** [MrTrenchTrucker/contak-browser-skills](https://github.com/MrTrenchTrucker/contak-browser-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-mrtrenchtrucker-contak-browser-skills-kasm-browser
- Seller: https://agentstack.voostack.com/s/mrtrenchtrucker
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.