Agent skill

Browser Login

by ruvnet in ruvnet/ruflo

Drive an authentication flow once, sanitize cookies through AIDefence, and vault a reusable cookie handle in browser-cookies for future sessions

MITAuto-check: notesBackend & APIs

Install Browser Login

skills CLI
$ npx skills add ruvnet/ruflo --skill browser-login -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install ruvnet/ruflo browser-login --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/ruvnet/ruflo.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/ruflo-browser/skills/browser-login .claude/skills/browser-login && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
browser-login
GitHub stars
74k
Used in
1 other repo
Token cost
~802 tokens
SKILL.md length
296 words
Files
1
Skills in repo
264
Repo updated
First seen
Licence
MIT

At a glance

Drive an authentication flow once, sanitize cookies through AIDefence, and vault a reusable cookie handle in browser-cookies for future sessions

  • Works in 7 steps: Open a recorded session via… → Drive the auth flow — fill credentials… → Handle MFA (when --mfa): pause for user… → …
  • Tasks that involve Authentication
  • SKILL.md covers When to use, Steps and Caveats
  • Calls npx

What it does

Browser Login is an agent skill from ruvnet/ruflo. Drive an authentication flow once, sanitize cookies through AIDefence, and vault a reusable cookie handle in browser-cookies for future sessions

Its SKILL.md is about 800 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Backend & APIs, covering Authentication. The repository describes itself as: 🌊 The original agent harness. Deploy intelligent multi-player swarms, coordinate autonomous workflows, and build conversational AI systems. Features adaptive memory…. The licence is MIT.

When your agent uses it

  • Tasks that involve Authentication

Example prompts

  • “/browser-login”

Requirements

  • Node.js
  • Pre-approved tools (allowed-tools): mcp__plugin_ruflo-core_ruflo__browser_open, mcp__plugin_ruflo-core_ruflo__browser_close, mcp__plugin_ruflo-core_ruflo__browser_fill, mcp__plugin_ruflo-core_ruflo__browser_type, mcp__plugin_ruflo-core_ruflo__browser_click, mcp__plugin_ruflo-core_ruflo__browser_wait, mcp__plugin_ruflo-core_ruflo__browser_eval, mcp__plugin_ruflo-core_ruflo__browser_snapshot, mcp__plugin_ruflo-core_ruflo__aidefence_scan, mcp__plugin_ruflo-core_ruflo__aidefence_has_pii, Bash, Read, Write

Workflow steps

7 steps, taken from the first numbered list in SKILL.md.

  1. Open a recorded session via browser-record.
  2. Drive the auth flow — fill credentials with browser_fill / browser_type. Credentials come from the user or environment; do not read them…
  3. Handle MFA (when --mfa): pause for user input or invoke the user's TOTP helper; capture only the resulting redirect, not the code itself.
  4. Capture cookies via browser_eval
  5. AIDefence sanitize
  6. Store in browser-cookies
  7. Return the vault handle so downstream skills can mount it via the planned browser_cookie_use MCP tool.

What it can do on your machine

Read from SKILL.md and the folder at commit 6051f67. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves these tools, so the agent can use them without asking each time:

    • mcp__plugin_ruflo-core_ruflo__browser_open
    • mcp__plugin_ruflo-core_ruflo__browser_close
    • mcp__plugin_ruflo-core_ruflo__browser_fill
    • mcp__plugin_ruflo-core_ruflo__browser_type
    • mcp__plugin_ruflo-core_ruflo__browser_click
    • mcp__plugin_ruflo-core_ruflo__browser_wait
    • mcp__plugin_ruflo-core_ruflo__browser_eval
    • mcp__plugin_ruflo-core_ruflo__browser_snapshot
    • mcp__plugin_ruflo-core_ruflo__aidefence_scan
    • mcp__plugin_ruflo-core_ruflo__aidefence_has_pii

    …and 3 more on the same allowed-tools line.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • npx

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use npx, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Browser Login loads about 802 tokens when it runs. Until then it costs about 40 tokens; SKILL.md has 296 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~40
When it runs · the whole SKILL.md, loaded when a task matches
~802

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

  • NoteMentions a .env fileSKILL.md:21
    environment; do **not** read them from `.env` or paste them into the trajectory args.
  • NotePre-approves every shell command (allowed-tools: Bash)SKILL.md
    allowed-tools: mcp__plugin_ruflo-core_ruflo__browser_open, mcp__plugin_ruflo-core_ruflo__browser_close, mcp__plugin

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from ruvnet/ruflo at commit 6051f67, republished under its MIT licence (© ruvnet). 296 words, ~802 tokens.

Download SKILL.mdSave it as .claude/skills/browser-login/SKILL.md (or your agent's skills folder).
name
browser-login
description
Drive an authentication flow once, sanitize cookies through AIDefence, and vault a reusable cookie handle in browser-cookies for future sessions
allowed-tools
mcp__plugin_ruflo-core_ruflo__browser_open, mcp__plugin_ruflo-core_ruflo__browser_close, mcp__plugin_ruflo-core_ruflo__browser_fill, mcp__plugin_ruflo-core_ruflo__browser_type, mcp__plugin_ruflo-core_ruflo__browser_click, mcp__plugin_ruflo-core_ruflo__browser_wait, mcp__plugin_ruflo-core_ruflo__browser_eval, mcp__plugin_ruflo-core_ruflo__browser_snapshot, mcp__plugin_ruflo-core_ruflo__aidefence_scan, mcp__plugin_ruflo-core_ruflo__aidefence_has_pii, Bash, Read, Write
argument-hint
<login-url> [--vault-name <handle>] [--mfa]

Browser Login

Authenticate against a target site once, then vault the resulting session credentials so subsequent skills (browser-extract, browser-form-fill, browser-test) can reuse them without re-driving the auth flow. Borrows the pattern from Browserbase's cookie-sync/SKILL.md but stores the resulting context in AgentDB rather than on a hosted backend.

When to use

  • Establishing reusable auth for a host the agent will visit repeatedly.
  • Refreshing a vaulted cookie set whose expiry has passed.
  • Capturing an MFA-protected session that requires interactive completion.

Steps

  1. Open a recorded session via browser-record.
  2. Drive the auth flow — fill credentials with browser_fill / browser_type. Credentials come from the user or environment; do not read them from .env or paste them into the trajectory args.
  3. Handle MFA (when --mfa): pause for user input or invoke the user's TOTP helper; capture only the resulting redirect, not the code itself.
  4. Capture cookies via browser_eval:
    javascript
    document.cookie  // returns the cookie string for the active document
    Or use the Playwright context API where exposed.
  5. AIDefence sanitize:
    bash
    # Each cookie value passes aidefence_scan to flag raw secrets / high-entropy tokens.
    Tokens that look raw get vault-wrapped (an opaque handle) before AgentDB store; raw values never enter the namespace.
  6. Store in browser-cookies:
    bash
    npx -y @claude-flow/cli@latest memory store --namespace browser-cookies \
      --key "<host>" \
      --value "{vault_handle:<opaque>, expiry:<iso>, aidefence_verdict:safe}"
  7. Return the vault handle so downstream skills can mount it via the planned browser_cookie_use MCP tool.

Caveats

  • Never log raw cookie values, tokens, or passwords. The trajectory step for the auth POST records only the form field names and a <redacted> placeholder for values.
  • The browser_cookie_use MCP tool is reserved (ADR-0001 §7) but not yet implemented. Until then, downstream skills mount the vaulted cookies via a helper bash function in scripts/ (TBD).
  • Some sites bind cookies to a UA fingerprint; if a vaulted cookie fails on reuse, re-run browser-login. Do not attempt to fingerprint-match yourself.
  • This skill is not a credential storage solution. The vault-handle pattern protects against AgentDB leaks, not against compromise of the agent's environment.

© ruvnet, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in plugins/ruflo-browser/skills/browser-login of ruvnet/ruflo.

Open the folder on GitHubat commit 6051f67

Used in 1 other repository

We found 2 copies of this SKILL.md (exact, near-identical or edited) in other folders, from 1 other GitHub owner. This page covers the copy in ruvnet/ruflo, which our catalogue first saw on October 7, 2026.

Compare with similar skills

Browser Login next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Browser Login compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Browser Login this skillruvnet/ruflo74k1 repos~802Automated safety check: NotesMIT
Fortify Developmentcoollabsio/coolify63k4 repos~1.9kAutomated safety check: PassMIT
Supabase Development and Debuggingsupabase/agent-skills2.7k3 repos~3.6kAutomated safety check: PassMIT
Better Auth Best Practiceslatitude-dev/latitude-llm4.7k7 repos~1.6kAutomated safety check: PassMIT
Supabasecurvenote/curvenote1695 repos~2.2kAutomated safety check: PassCustom licence
Gitnexus Exploringaws-samples/sample-kolya-br-proxy10611 repos~749Automated safety check: PassMIT-0

Similar skills

  • Fortify Development

    coollabsio/coolify

    ACTIVATE when the user works on authentication in Laravel. An agent skill from coollabsio/coolify.

    63k GitHub starsUsed in 4 repos~1.9k tokens
    Backend & APIsAuto-check passed
  • Official

    General Supabase skill for database, auth, Edge Functions, Realtime and storage work, plus client libraries, migrations, security audits, debugging and reading logs.

    2.7k GitHub starsUsed in 3 repos~3.6k tokens
    Backend & APIsAuto-check passed
  • Better Auth Best Practices

    latitude-dev/latitude-llm

    Configure Better Auth server and client, set up database adapters, manage sessions, add plugins, and handle environment variables.

    4.7k GitHub starsUsed in 7 repos~1.6k tokens
    Backend & APIsAuto-check passed
  • Supabase

    curvenote/curvenote

    A skill your agent uses when doing ANY task involving Supabase.

    169 GitHub starsUsed in 5 repos~2.2k tokens
    Backend & APIsAuto-check passed
  • Gitnexus Exploring

    aws-samples/sample-kolya-br-proxy

    Official

    A skill your agent uses when the user asks how code works, wants to understand architecture, trace execution flows, or explore unfamiliar parts of the codebase.

    106 GitHub starsUsed in 11 repos~749 tokens
    Backend & APIsAuto-check passed
  • Agentic Wallet

    coinbase/agentic-wallet-skills

    Crypto wallet operations via the awal CLI — sign in, check balances, send USDC/ETH/POL/SOL, trade tokens, fund the wallet, and use the x402 payment protocol to discover paid services, pay for API…

    127 GitHub starsUsed in 3 repos~1k tokens
    Backend & APIsAuto-check passed

More from ruvnet/ruflo

All 264 skills in this repo
  • Stores, searches, and retrieves successful patterns with HNSW-indexed semantic search so agents can reuse past solutions instead of relearning them.

    74k GitHub starsUsed in 3 repos~830 tokens
    Auto-check passed
  • Runs claude-flow CLI security scans for input validation, path traversal, SQL injection, XSS, hardcoded secrets and known CVEs, and writes an audit report.

    74k GitHub starsUsed in 2 repos~823 tokens
    Auto-check passed
  • Applies the SPARC method (specification, pseudocode, architecture, refinement, completion) with 17 specialized modes and multi-agent orchestration, from research to deployment.

    74k GitHub starsUsed in 2 repos~829 tokens
    Auto-check passed
  • Coordinates a hierarchical swarm of specialized agents through the claude-flow CLI for work that spans several files or modules at once.

    74k GitHub starsUsed in 2 repos~779 tokens
    Auto-check passed
  • Sets up and drives Ruflo, an npm-installed orchestration layer for multi-agent swarms, persistent memory, routing, hooks and its MCP tool catalog.

    74k GitHub starsUsed in 1 repo~975 tokens
    Auto-check passed
  • Agent Coordination

    ruvnet/ruflo

    Reference for spawning, listing, monitoring and stopping agents with claude-flow commands, with agent type families, routing codes and coordination tips.

    74k GitHub starsUsed in 2 repos~519 tokens
    Auto-check passed

Categories

Questions about Browser Login

What does Browser Login do?

Drive an authentication flow once, sanitize cookies through AIDefence, and vault a reusable cookie handle in browser-cookies for future sessions. Browser Login is an agent skill from ruvnet/ruflo.

When should I use Browser Login?

Browser Login fits situations like: tasks that involve Authentication.

How do I install Browser Login in Claude Code?

Run `npx skills add ruvnet/ruflo --skill browser-login -a claude-code`. Or copy the skill folder (plugins/ruflo-browser/skills/browser-login in ruvnet/ruflo) into .claude/skills/browser-login in your project. Claude Code loads it when a task matches its description.

How do I install Browser Login in Codex?

Run `npx skills add ruvnet/ruflo --skill browser-login -a codex`. Or copy the skill folder (plugins/ruflo-browser/skills/browser-login in ruvnet/ruflo) into .agents/skills/browser-login in your project. Codex loads it when a task matches its description.

Can I use Browser Login in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add ruvnet/ruflo --skill browser-login -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/browser-login, .gemini/skills/browser-login, .github/skills/browser-login and .opencode/skills/browser-login in your project.

What does Browser Login need to run?

Going by SKILL.md and its folder, Browser Login needs the command-line tools its instructions call (npx). Our summary lists: Node.js. Its frontmatter pre-approves these tools: mcp__plugin_ruflo-core_ruflo__browser_open, mcp__plugin_ruflo-core_ruflo__browser_close, mcp__plugin_ruflo-core_ruflo__browser_fill, mcp__plugin_ruflo-core_ruflo__browser_type, mcp__plugin_ruflo-core_ruflo__browser_click, mcp__plugin_ruflo-core_ruflo__browser_wait, mcp__plugin_ruflo-core_ruflo__browser_eval, mcp__plugin_ruflo-core_ruflo__browser_snapshot, mcp__plugin_ruflo-core_ruflo__aidefence_scan, mcp__plugin_ruflo-core_ruflo__aidefence_has_pii, Bash, Read, Write.

Does Browser Login access the network?

SKILL.md contains no URLs. Its commands use npx, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Browser Login safe to install?

Our automated static check of SKILL.md found notes only (mentions a .env file; pre-approves every shell command (allowed-tools: bash)), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.

What licence does Browser Login use?

Browser Login is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Browser Login use?

About 802 tokens (SKILL.md is roughly 3.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Browser Login?

Skills that share tags, products or a category with Browser Login: Fortify Development (coollabsio/coolify, 63k stars), Supabase Development and Debugging (supabase/agent-skills, 2.7k stars), Better Auth Best Practices (latitude-dev/latitude-llm, 4.7k stars) and Supabase (curvenote/curvenote, 169 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Browser Login?

ruvnet (a GitHub user) maintains it in ruvnet/ruflo, which has 74,089 GitHub stars. The repository holds 264 skills in this directory. The repository was last updated on October 8, 2026.

Source: ruvnet/ruflo on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.