setup-browser-cookies — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited setup-browser-cookies (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use when asked to "import cookies", "login to the site", or "authenticate the browser".
eval "$(~/.vibestack/bin/vibe-slug 2>/dev/null)" 2>/dev/null || SLUG="unknown"
_LEARN_FILE="${VIBESTACK_HOME:-$HOME/.vibestack}/projects/${SLUG:-unknown}/learnings.jsonl"
if [ -f "$_LEARN_FILE" ]; then
_LEARN_COUNT=$(wc -l < "$_LEARN_FILE" 2>/dev/null | tr -d ' ')
echo "LEARNINGS: $_LEARN_COUNT entries loaded"
if [ "$_LEARN_COUNT" -gt 5 ] 2>/dev/null; then
~/.vibestack/bin/vibe-learnings-search --limit 5 2>/dev/null || true
fi
else
echo "LEARNINGS: none yet"
fi{{include lib/snippets/session-host.md}}
{{include lib/snippets/decision-brief.md}}
{{include lib/snippets/working-protocols.md}}
{{include lib/snippets/state-protocols.md}}
Import logged-in sessions from your real Chromium browser into the headless browse session.
First, check if browse is already connected to the user's real browser:
$B status 2>/dev/null | grep -q "Mode: cdp" && echo "CDP_MODE=true" || echo "CDP_MODE=false"If CDP_MODE=true: tell the user "Not needed — you're connected to your real browser via CDP. Your cookies and sessions are already available." and stop. No cookie import needed.
cookie-import-browser to detect installed browsers and open the picker UI_ROOT=$(git rev-parse --show-toplevel 2>/dev/null)
B=""
[ -n "$_ROOT" ] && [ -x "$_ROOT/.claude/skills/vibestack/browse/dist/browse" ] && B="$_ROOT/.claude/skills/vibestack/browse/dist/browse"
[ -z "$B" ] && B="$HOME/.claude/skills/vibestack/browse/dist/browse"
if [ -x "$B" ]; then echo "READY: $B"; else echo "NEEDS_SETUP"; fiIf NEEDS_SETUP, stop and tell the user: "The browse daemon is required for this skill but is not installed. vibestack does not bundle the browse daemon — it's a separate dependency. See docs/external-tools.md for current options."
$B cookie-import-browserThis auto-detects installed Chromium browsers and opens an interactive picker UI in your default browser where you can:
Tell the user: "Cookie picker opened — select the domains you want to import in your browser, then tell me when you're done."
If the user specifies a domain directly (e.g., /setup-browser-cookies github.com), skip the UI:
$B cookie-import-browser comet --domain github.comReplace comet with the appropriate browser if specified.
After the user confirms they're done:
$B cookiesShow the user a summary of imported cookies (domain counts).
v11 cookies may require secret-tool/libsecret access; v10 cookies use Chromium's standard fallback key~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.