# Cloakbrowser

> Stealth Chromium browser automation that bypasses bot detection. Use this skill whenever the user wants to scrape, screenshot, PDF, or automate a site that blocks normal headless browsers — Cloudflare Turnstile, reCAPTCHA v3, FingerprintJS, ShieldSquare, BrowserScan, "Access Denied" responses, suspicious 403/429s on plain `curl`, or any site where Playwright/Puppeteer get caught. Also use when th…

- **Type:** Skill
- **Install:** `agentstack add skill-octaviantocan-cloakbrowser-skill-cloakbrowser-skill`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [OctavianTocan](https://agentstack.voostack.com/s/octaviantocan)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [OctavianTocan](https://github.com/OctavianTocan)
- **Source:** https://github.com/OctavianTocan/cloakbrowser-skill
- **Website:** https://github.com/CloakHQ/CloakBrowser

## Install

```sh
agentstack add skill-octaviantocan-cloakbrowser-skill-cloakbrowser-skill
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# CloakBrowser

A patched-source Chromium plus a Playwright-shaped Python wrapper. Fingerprints
are modified at the C++ level (canvas, WebGL, audio, fonts, WebRTC, TLS, CDP
input, `navigator.webdriver`, plugin list, `window.chrome`, …) so detection
services see a real browser because it **is** a real browser — no JS shim that
breaks on the next Chrome upgrade.

## Install state on this VPS

Already installed:

- `cloakbrowser` CLI lives at `/home/node/.local/bin/cloakbrowser` in the
  stable OpenClaw container image.
- Stealth Chromium binary lives at
  `/home/node/.cloakbrowser/chromium-/chrome`.
- Wrapper Python is exposed through `/usr/local/bin/cloakbrowser-python`; the
  bundled scripts use this stable wrapper so they work even when Codex sets
  `HOME` to an isolated session directory.

If a fresh checkout or a new machine needs setting up:

```bash
uv tool install cloakbrowser
cloakbrowser install        # downloads the ~206 MB Chromium binary
```

The `cloakbrowser` CLI only manages the binary (`install`, `info`, `update`,
`clear-cache`). It is **not** a scraper — for that, use the scripts in this
skill or write inline Python.

## Decision tree — pick the right tool

| Task                                                          | Use                            |
|---------------------------------------------------------------|--------------------------------|
| Get the HTML or visible text of a page                        | `scripts/fetch.py`             |
| Save a PNG of a page or element                               | `scripts/screenshot.py`        |
| Render a page to PDF                                          | `scripts/pdf.py`               |
| Run a JS expression against a page and get JSON back          | `scripts/eval-js.py`           |
| Confirm stealth is working                                    | `scripts/check-stealth.py`     |
| Long-lived browser shared across many tool calls / skills     | `scripts/serve.sh` + CDP       |
| Multi-step interactive flow (login, click, type, conditional) | Inline Python — see below      |

Always reach for a bundled script first. They use `argparse`, take `--humanize`,
`--proxy`, `--geoip`, `--wait`, etc. — most needs are covered.

## Bundled scripts

All scripts are executable (`#!` already points at the right Python). Invoke
them by absolute path:

```bash
SK=/root/.openclaw/skills/cloakbrowser/scripts

$SK/fetch.py https://example.com                       # full HTML on stdout
$SK/fetch.py https://example.com --text                # visible text only
$SK/fetch.py https://example.com --selector "h1"       # scoped to a selector
$SK/fetch.py https://protected.example --humanize      # behavioural stealth
$SK/fetch.py https://geo.example --proxy socks5://u:p@host:1080 --geoip

$SK/screenshot.py https://example.com /tmp/out.png --full
$SK/screenshot.py https://example.com /tmp/hero.png --selector ".hero"
$SK/screenshot.py https://example.com /tmp/m.png --viewport 390x844

$SK/pdf.py https://example.com /tmp/page.pdf --format A4
$SK/pdf.py https://example.com /tmp/wide.pdf --landscape

$SK/eval-js.py https://news.example "Array.from(document.querySelectorAll('h2')).map(h=>h.innerText)"
$SK/eval-js.py https://example.com  "({ua: navigator.userAgent, w: innerWidth})"

$SK/check-stealth.py        # JSON report + exit 0 if all 4 stealth tells pass

$SK/serve.sh --port 9222    # starts cloakserve in background; logs /tmp/cloakserve.log
```

The pattern is consistent: positional `URL` (and `OUTPUT` where relevant), then
optional flags `--humanize`, `--proxy`, `--geoip`, `--wait`, `--timeout`.

## Inline Python — for everything the scripts don't cover

For multi-step flows (login, fill a form, click through, conditional waits),
write a one-off script. Use the uv tool venv's interpreter:

```bash
CB_PY=/usr/local/bin/cloakbrowser-python

"$CB_PY" - <<'PY'
from cloakbrowser import launch
b = launch(headless=True, humanize=True)
p = b.new_page()
p.goto("https://example.com/login", wait_until="domcontentloaded")
p.fill("#email", "me@example.com")
p.fill("#password", "…")
p.click("button[type=submit]")
p.wait_for_url("**/dashboard**")
print(p.title())
b.close()
PY
```

The API is identical to Playwright's sync API — anything in the Playwright
docs works here. The only differences:

- `from cloakbrowser import launch` (not `from playwright.sync_api`)
- Skip `sync_playwright().start()` — `launch()` is a top-level function
- All stealth flags (`humanize`, `proxy`, `geoip`, `auto_update`) go on
  `launch()`, not the page

For persistent sessions, use `launch_persistent_context(user_data_dir)`.

## When to load `references/stealth-knobs.md`

Read it when:

- A target blocks despite stealth (covers `humanize` / proxy / persistent
  profile escalation order).
- The user asks about proxies, residential vs datacentre, geo matching.
- You need to share one browser across many tool calls (CDP server mode).

For routine "fetch this URL" / "screenshot this page" work, the table and
script examples above are enough — don't load the reference.

## Anti-patterns

- Don't `pip install cloakbrowser` system-wide. PEP 668 blocks it on this VPS.
  Use `uv tool install cloakbrowser` (already done).
- Don't run `playwright install` — CloakBrowser ships its own Chromium and
  doesn't use Playwright's bundled binaries.
- Don't import `cloakbrowser` from the system Python — it lives in the uv
  tool venv only. Use the venv's Python, or the bundled scripts.
- Don't enable `humanize=True` for plain scraping of unprotected sites — it
  adds latency with no win.
- Don't keep `serve.sh` running for a one-shot fetch. The CDP server is for
  shared, long-lived sessions; `fetch.py` is faster for one URL.

## Troubleshooting

- `Binary not found` / first-run hang → `cloakbrowser install`.
- `ModuleNotFoundError: cloakbrowser` → you're on the wrong Python. Use
  `/usr/local/bin/cloakbrowser-python` or the bundled scripts (their shebang
  already points there).
- Slow startup → the binary checks for updates on launch. Pass
  `auto_update=False` to `launch()` (or set `CLOAKBROWSER_AUTO_UPDATE=0`) to
  skip.
- Still blocked → see `references/stealth-knobs.md` for the escalation order
  (`humanize` → residential proxy + `geoip` → persistent profile).

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [OctavianTocan](https://github.com/OctavianTocan)
- **Source:** [OctavianTocan/cloakbrowser-skill](https://github.com/OctavianTocan/cloakbrowser-skill)
- **License:** MIT
- **Homepage:** https://github.com/CloakHQ/CloakBrowser

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-octaviantocan-cloakbrowser-skill-cloakbrowser-skill
- Seller: https://agentstack.voostack.com/s/octaviantocan
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.