Install
$ agentstack add skill-openqa-cn-jev-browser-jev-browser ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ● Environment & secrets Used
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
CodexQA Jev Browser
Drive a real browser through the codexqa-jev-browser CLI (TypeScript). Do not invent CSS/XPath/coordinates or replace the engine with a host browser tool.
Choose a mode
- Existing YAML, Markdown, or API cases →
run - Only a natural-language goal →
autoorgenerate - Unknown site / coverage →
explore
Install once, from this skill directory (the directory that contains package.json and SKILL.md):
npm install
Playwright Chromium is the browser. Do not read another application's browser profile.
Commands
npx codexqa-jev-browser observe
npx codexqa-jev-browser run cases/examples/search-docs.yaml
npx codexqa-jev-browser run cases/examples/search-docs.md
npx codexqa-jev-browser run --from-api https://qa.example.com/cases?suite=smoke
npx codexqa-jev-browser auto --url --goal ''
npx codexqa-jev-browser generate --url --goal '' --out generated/case.yaml --md --verify
npx codexqa-jev-browser explore --url --out generated/explore
The browser window is shown by default. Set browser.headless: true to hide it. --headed forces a visible window. --no-screenshots skips images.
Model setup
Do this before live auto / generate --goal. The CLI calls Jev or an OpenAI-compatible API itself. The host Cursor/Codex session model is not the decision model. observe, run, explore, and --decisions do not need a key. Do not stop those commands to ask for one.
Keys live in a .env file, not in the chat. The CLI loads the .env next to this SKILL.md first, then a repo-root .env, and does not override variables already set in the shell.
- Read that
.env(or.env.exampleif.envis missing). IfTYPESAFE_API_KEYorOPENAI_API_KEYis already set, run the command. Do not ask again. - If neither key is set, copy
.env.exampleto.envin the skill directory and tell the user to fill that file. Do not ask them to paste a key into the chat. Show this shape:
# Each step: which control, which goal phrase to type, whether the step worked, whether the task is done.
TYPESAFE_API_KEY=
TYPESAFE_MODEL=jev-latest
TYPESAFE_BASE_URL=https://api.typesafe.ai/v1
# Task plan before the browser opens. Also the decision and the done check when TYPESAFE_API_KEY is empty.
OPENAI_API_KEY=
OPENAI_BASE_URL=https://api.openai.com/v1
OPENAI_MODEL=gpt-4o-mini
TEXT_MODEL=gpt-4o-mini
- Prefer Jev when
TYPESAFE_API_KEYis set.OPENAI_MODELis only the planner unless Jev is unset. A third-party gateway isOPENAI_BASE_URLorTYPESAFE_BASE_URL, not a separate product. SetHTTPS_PROXYin the same.envonly when that gateway needs a proxy. generatewrites the YAML after every successful step. Do not hand-author the case step by step while the run is walking the site.- Never write a key into case YAML. Never commit
.env.
Optional CLI overrides (never --api-key): --model, --base-url, --config. Model name and gateway may also live in codexqa-jev-browser.config.yaml as ${OPENAI_API_KEY}-style placeholders.
After every run
Open or summarize reports//report.html before concluding. It contains suite totals, every step, and screenshots. Exit code is non-zero on failure. report.json is the machine-readable copy; report.md is the short summary.
Hard rules
- Model output may only choose an operation plus an observed index. Never execute model-written selectors, JS, or shell.
DONEis not success. Assertions or visible evidence decide the result.- Secrets stay in environment variables (
${PASSWORD}), never in case files. - Confirm before explore/auto on logout, delete, pay, or other destructive controls.
- Prefer semantic targets:
{role, name, nth, within}.
Business knowledge
Per-app notes live in knowledge//*.md. On live auto / generate --goal, the CLI matches the start URL and the goal against each note's hosts and keywords, then appends the hits to the planner, the decision goal, and the field-text prompt. A note with general: true is included on every run.
Notes are reference for what to type and which visible control to prefer. They do not add operations. Do not copy them into case YAML. Add a new app by adding a note. Do not put that app's fill rules back into src/policy.ts.
Case sources
- YAML is the source of truth. Markdown uses numbered Click/Type/Select/Scroll/Wait/Assert/HTTP lines.
--from-apipulls cases; steps may also useop: httpfor setup or backend checks.
Schema and verbs: [references/schema.md](references/schema.md). Examples: [references/examples.md](references/examples.md).
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: openqa-cn
- Source: openqa-cn/jev-browser
- License: MIT
- Homepage: https://github.com/openqa-cn/codexqa
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.