gstack — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited gstack (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Persistent headless Chromium. First call auto-starts (~3s), then ~100-200ms per command. Auto-shuts down after 30 min idle. State persists between calls (cookies, tabs, sessions).
BROWSE_OUTPUT=$(browse/bin/find-browse 2>/dev/null || ~/.claude/skills/gstack/browse/bin/find-browse 2>/dev/null)
B=$(echo "$BROWSE_OUTPUT" | head -1)
META=$(echo "$BROWSE_OUTPUT" | grep "^META:" || true)
if [ -n "$B" ]; then
echo "READY: $B"
[ -n "$META" ] && echo "$META"
else
echo "NEEDS_SETUP"
fiIf NEEDS_SETUP:
cd <SKILL_DIR> && ./setupbun is not installed: curl -fsSL https://bun.sh/install | bashIf you see META:UPDATE_AVAILABLE:
current, latest, and command.$B <command>mcp__claude-in-chrome__* tools. They are slow and unreliable.Always resolve the binary through the shim — never hardcode a dist/ path:
| Path | Purpose |
|---|---|
browse/bin/find-browse | Cross-platform entry-point shim (POSIX bash). Delegates to compiled find-browse if present, falls back to basic discovery. Use this everywhere. |
browse/dist/find-browse (.exe on Windows) | Compiled discovery helper. Adds version checking + META:UPDATE_AVAILABLE signal. Auto-invoked by the shim. |
browse/dist/browse (.exe on Windows) | The actual headless browser binary. Path printed by the shim on stdout. |
Canonical resolve pattern (use in every skill that needs the binary):
B=$(~/.claude/skills/gstack/browse/bin/find-browse 2>/dev/null | head -1)
[ -z "$B" ] && { echo "ERROR: browse not built. Run: cd ~/.claude/skills/gstack && ./setup"; exit 1; }Platform suffix is auto-resolved by the shim — on Windows it picks find-browse.exe / browse.exe, on macOS/Linux the unsuffixed binaries. See BINARIES.md for the full artifact inventory.
B=$(~/.claude/skills/gstack/browse/bin/find-browse | head -1)
# 1. Go to the page
$B goto https://app.example.com/login
# 2. See what's interactive
$B snapshot -i
# 3. Fill the form using refs
$B fill @e3 "[email protected]"
$B fill @e4 "password123"
$B click @e5
# 4. Verify it worked
$B snapshot -D # diff shows what changed after clicking
$B is visible ".dashboard" # assert the dashboard appeared
$B screenshot /tmp/after-login.png$B goto https://yourapp.com
$B text # read the page — does it load?
$B console # any JS errors?
$B network # any failed requests?
$B js "document.title" # correct title?
$B is visible ".hero-section" # key elements present?
$B screenshot /tmp/prod-check.png# Navigate to the feature
$B goto https://app.example.com/new-feature
# Take annotated screenshot — shows every interactive element with labels
$B snapshot -i -a -o /tmp/feature-annotated.png
# Find ALL clickable things (including divs with cursor:pointer)
$B snapshot -C
# Walk through the flow
$B snapshot -i # baseline
$B click @e3 # interact
$B snapshot -D # what changed? (unified diff)
# Check element states
$B is visible ".success-toast"
$B is enabled "#next-step-btn"
$B is checked "#agree-checkbox"
# Check console for errors after interactions
$B console# Quick: 3 screenshots at mobile/tablet/desktop
$B goto https://yourapp.com
$B responsive /tmp/layout
# Manual: specific viewport
$B viewport 375x812 # iPhone
$B screenshot /tmp/mobile.png
$B viewport 1440x900 # Desktop
$B screenshot /tmp/desktop.png$B goto https://app.example.com/upload
$B snapshot -i
$B upload @e3 /path/to/test-file.pdf
$B is visible ".upload-success"
$B screenshot /tmp/upload-result.png$B goto https://app.example.com/form
$B snapshot -i
# Submit empty — check validation errors appear
$B click @e10 # submit button
$B snapshot -D # diff shows error messages appeared
$B is visible ".error-message"
# Fill and resubmit
$B fill @e3 "valid input"
$B click @e10
$B snapshot -D # diff shows errors gone, success state# Set up dialog handling BEFORE triggering
$B dialog-accept # will auto-accept next alert/confirm
$B click "#delete-button" # triggers confirmation dialog
$B dialog # see what dialog appeared
$B snapshot -D # verify the item was deleted
# For prompts that need input
$B dialog-accept "my answer" # accept with text
$B click "#rename-button" # triggers prompt# Import cookies from your real browser (opens interactive picker)
$B cookie-import-browser
# Or import a specific domain directly
$B cookie-import-browser comet --domain .github.com
# Now test authenticated pages
$B goto https://github.com/settings/profile
$B snapshot -i
$B screenshot /tmp/github-profile.png$B diff https://staging.app.com https://prod.app.comecho '[
["goto","https://app.example.com"],
["snapshot","-i"],
["fill","@e3","[email protected]"],
["fill","@e4","password"],
["click","@e5"],
["snapshot","-D"],
["screenshot","/tmp/result.png"]
]' | $B chain# Element exists and is visible
$B is visible ".modal"
# Button is enabled/disabled
$B is enabled "#submit-btn"
$B is disabled "#submit-btn"
# Checkbox state
$B is checked "#agree"
# Input is editable
$B is editable "#name-field"
# Element has focus
$B is focused "#search-input"
# Page contains text
$B js "document.body.textContent.includes('Success')"
# Element count
$B js "document.querySelectorAll('.list-item').length"
# Specific attribute value
$B attrs "#logo" # returns all attributes as JSON
# CSS property
$B css ".button" "background-color"The snapshot is your primary tool for understanding and interacting with pages.
$B snapshot -i # Interactive elements only (buttons, links, inputs) with @e refs
$B snapshot -c # Compact (no empty structural elements)
$B snapshot -d 3 # Limit depth to 3 levels
$B snapshot -s "main" # Scope to CSS selector
$B snapshot -D # Diff against previous snapshot (what changed?)
$B snapshot -a # Annotated screenshot with ref labels
$B snapshot -o /tmp/x.png # Output path for annotated screenshot
$B snapshot -C # Cursor-interactive elements (@c refs — divs with pointer, onclick)Combine flags: $B snapshot -i -a -C -o /tmp/annotated.png
After snapshot, use @refs everywhere:
$B click @e3 $B fill @e4 "value" $B hover @e1
$B html @e2 $B css @e5 "color" $B attrs @e6
$B click @c1 # cursor-interactive ref (from -C)Refs are invalidated on navigation — run snapshot again after goto.
| Command | Description |
|---|---|
goto <url> | Navigate to URL |
back / forward | History navigation |
reload | Reload page |
url | Print current URL |
| Command | Description |
|---|---|
text | Cleaned page text |
html [selector] | innerHTML |
links | All links as "text -> href" |
forms | Forms + fields as JSON |
accessibility | Full ARIA tree |
| Command | Description |
|---|---|
click <sel> | Click element |
fill <sel> <val> | Fill input |
select <sel> <val> | Select dropdown |
hover <sel> | Hover element |
type <text> | Type into focused element |
press <key> | Press key (Enter, Tab, Escape) |
scroll [sel] | Scroll element into view |
wait <sel> | Wait for element (max 10s) |
wait --networkidle | Wait for network to be idle |
wait --load | Wait for page load event |
upload <sel> <file...> | Upload file(s) |
cookie-import <json> | Import cookies from JSON file |
cookie-import-browser [browser] [--domain <d>] | Import cookies from real browser (opens picker UI, or direct import with --domain) |
dialog-accept [text] | Auto-accept dialogs |
dialog-dismiss | Auto-dismiss dialogs |
viewport <WxH> | Set viewport size |
| Command | Description | |
|---|---|---|
js <expr> | Run JavaScript | |
eval <file> | Run JS file | |
css <sel> <prop> | Computed CSS | |
attrs <sel> | Element attributes | |
is <prop> <sel> | State check (visible/hidden/enabled/disabled/checked/editable/focused) | |
| `console [--clear\ | --errors]` | Console messages (--errors filters to error/warning) |
network [--clear] | Network requests | |
dialog [--clear] | Dialog messages | |
cookies | All cookies | |
storage | localStorage + sessionStorage | |
perf | Page load timings |
| Command | Description |
|---|---|
screenshot [path] | Screenshot |
pdf [path] | Save as PDF |
responsive [prefix] | Mobile/tablet/desktop screenshots |
diff <url1> <url2> | Text diff between pages |
| Command | Description |
|---|---|
tabs | List tabs |
tab <id> | Switch tab |
newtab [url] | Open tab |
closetab [id] | Close tab |
| Command | Description |
|---|---|
status | Health check |
stop | Shutdown |
restart | Restart |
goto loads the page; then text, js, screenshot all hit the loaded page instantly.is visible .modal is faster and more reliable than parsing page text.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.