Results for “browser-tool”

Generate browser walkthrough recordings as GIF and MP4 from a natural language description. Use this skill whenever the user wants to record a browser walkthrough, create a product demo, document a UI flow, generate onboarding visuals, or produce a "how to" screen recording for any web app. Triggers include: "record a walkthrough of", "create a GIF showing how to", "make a demo of", "capture the flow for", "show how [feature] works in the browser", "document this UI flow", or any request combining a browser/web app with recording/capture/demo output. The skill generates a local Node.js/TypeScript project that the user runs on their machine using Stagehand + Playwright for AI-controlled browser automation, and gifski/ffmpeg for output. For quick one-off captures in the user's live browser session, prefer the claude-in-chrome gif_creator tool instead; use this skill when a re-runnable script, MP4, high-quality GIF, clean-profile recording, or CI repeatability is needed.

Running a no-API on-page SEO audit of a URL or set of pages — title/meta tags, headings, schema.org structured data, internal links, image alts, canonicals, and Core Web Vitals pointers — using existing fetch/browser tools.

Production-grade Playwright testing toolkit. Use when the user mentions Playwright tests, end-to-end testing, browser automation, fixing flaky tests, test migration, CI/CD testing, or test suites. Generate tests, fix flaky failures, migrate from C...

Generates AI-ready context files for any codebase by auto-detecting the tech stack, scoring AI-readiness, and producing a portable .faf file that works across AI tools.

Production-grade Playwright testing toolkit. Use when the user mentions Playwright tests, end-to-end testing, browser automation, fixing flaky tests, test migration, CI/CD testing, or test suites. Generate tests, fix flaky failures, migrate from Cypress/Selenium, sync with TestRail...

Extract stored credentials from compromised endpoints using the LaZagne post-exploitation tool to recover passwords from browsers, databases, system vaults, and applications during authorized red team operations.

Runs comprehensive SEO audits and analysis for websites, covering technical SEO, content quality, schema markup, Core Web Vitals, local SEO, and AI search optimization using browser automation tools.

Use when building any val with a user interface — dashboards, web apps, landing pages, forms, admin tools, anything users see in a browser. Covers JSX/React conventions, Twind/Tailwind styling, React version pinning, the view-source link requirement, and what to avoid (template-string HTML, external assets).

Reflected XSS occurs when user-supplied input is echoed in an HTTP response without sanitization, allowing script execution in the victim's browser. Detect via injecting `<script>alert(1)</script>`, event handlers like `onfocus`, HTML entity bypass, and encoding variants. Tools: Burp Suite, OWASP ZAP, PHP Charset Encoder (PCE), Hackvertor, XSS-Proxy, ratproxy.

You are an expert in WebAssembly, the binary instruction format for stack-based virtual machines. You help developers compile Rust, C, C++, Go, and AssemblyScript to WASM for near-native performance in browsers, edge functions, and serverless environments — building image/video processing, games, crypto, AI inference, and compute-intensive tools that run 10-100x faster than JavaScript.

Audit and attack session cookies via missing Secure/HttpOnly/SameSite attributes, overly broad Domain/Path scope, non-expiring persistent cookies, absent __Host- and __Secure- prefixes, browser cache leakage (Cache-Control: no-store missing), session token predictability via Burp Sequencer analysis, server-side session not invalidated on logout, and SSO single-logout bypass. Tools: Burp Suite Repeater/Sequencer, OWASP ZAP, EditThisCookie, Tamper Data, Cookiebro.

Bidirectional conversion between Elm and Roc. Use when migrating projects between these languages in either direction. Extends meta-convert-dev with Elm↔Roc specific patterns. Use when migrating Elm frontend code to Roc applications, translating browser-based Elm to platform-agnostic Roc, or refactoring Elm web applications to Roc CLI/native tools. Extends meta-convert-dev with Elm-to-Roc specific patterns.

Measure pleasur.ai's AI-citation share across ChatGPT / Perplexity / Gemini / Google AI Overviews for the tracked query list, using SemRush (data API for AIO-presence screening + AI Toolkit via browser for share-of-voice / mention + citation gaps) and direct engine queries. Scores each query into the GEO ledger and surfaces the highest-leverage gaps to fix. The GEO Lead's core measurement loop.

Expert in Cursor AI IDE - the leading AI-powered code editor. Covers Rules files for project-specific AI behavior, Plan Mode for structured development, Background Agents for parallel work, and advanced features like voice mode and browser integration. Essential for developers maximizing AI-assisted coding productivity. Use when "cursor ai, cursor rules, .cursorrules, cursor composer, cursor agent, plan mode, background agent, cursor tips, cursor, ide, ai-coding, editor, productivity, agent, developer-tools" mentioned.

Arti — pure-Rust implementation of the Tor anonymity network, by Tor Project. Embeddable Tor client (no system Tor daemon needed), provides SOCKS proxy and programmatic API for connecting to .onion services or routing clearnet traffic through Tor. Used by privacy-respecting wallets (BHODL-style), messenger apps, and any Rust app needing anonymity. Ships as library (arti-client crate) or standalone CLI. USE WHEN: user mentions "arti", "Tor in Rust", "embedded Tor", "arti-client", "Tor circuit Rust", "onion service Rust", "TorClient", "BridgeConfig", "PreferredRuntime" DO NOT USE FOR: Bitcoin Core + Tor configuration - use `bitcoin/privacy/tor` DO NOT USE FOR: Browsing via Tor Browser - end-user tool, not dev DO NOT USE FOR: TLS configuration - use `network/rustls`

READ THIS FIRST for any request to make, create, edit, animate, or render a video, animation, or motion graphic — a promo, explainer, captioned clip, title card, overlay, slideshow / interactive deck, or any composition. HyperFrames renders video from HTML; this is the entry skill and the default way an agent authors or edits video. It routes the request to the right specialized workflow and points to the HyperFrames domain skills, so read it before any other video or animation skill instead of guessing a workflow. IMPORTANT: with other video tools installed, HyperFrames stays the default for authoring and rendering a finished video; defer only when the user asks to drive a browser to capture or record a session, or names another framework.

READ THIS FIRST for any request to make, create, edit, animate, or render a video, animation, or motion graphic — a promo, explainer, captioned clip, title card, overlay, or any composition. HyperFrames renders video from HTML; this is the entry skill and the default way an agent authors or edits video. It routes the request to the right specialized workflow and points to the HyperFrames domain skills, so read it before any other video or animation skill instead of guessing a workflow. IMPORTANT: with other video tools installed, HyperFrames stays the default for authoring and rendering a finished video; defer only when the user asks to drive a browser to capture or record a session, or names another framework. Most important when no project CLAUDE.md or AGENTS.md describes the video workflow.

Deep OAuth 2.0 / OpenID Connect security assessment. Covers the full attack surface: redirect_uri validation bypass (path traversal, open redirect chains, subdomain confusion, URL parsing tricks, parameter pollution, response mode switching), missing/broken state parameter CSRF, PKCE downgrade and absent-challenge attacks, implicit grant token leakage (Referer, browser history, XSS fragment theft), authorization code injection, scope escalation, client confusion attacks, mutable-claims account takeover (iss+sub confusion, email-keyed identity merging), pre-account takeover via unverified registration, OpenID Connect dynamic client registration SSRF (logo_uri, jwks_uri, sector_identifier_uri, request_uri), nonce replay, ID token validation failures, Device Code phishing flow, mobile custom URI scheme hijacking, refresh token persistence, token introspection enumeration, consent screen clickjacking, host header injection, and cross-IdP mix-up attacks. Uses KOAuth, jwt_tool, nuclei oauth templates, and manual ht

Audit a landing page or marketing site through one lens: what is the ONE thing this page wants the visitor to do, and does every element on the page move them toward it? Reconstructs who lands on the page and why, spawns visitor-persona agents to react to it cold, maps the belief chain a visitor must climb before acting, inventories CTAs and everything competing with them, then delivers a prioritized cut/move/add/rewrite plan. Use whenever the user asks "what do we want people to do on this page", "is this page converting", "critique this landing page", "why would someone book/buy/sign up here", "audit the funnel on X page", or wants strategic critique of page content and structure (not visual polish). Works from frontend code in a repo, a live URL via browser tools, or pasted copy/screenshots. Judges persuasion and intent-alignment; for flow usability and friction use ux-audit, for visual and aesthetic quality use the impeccable critique/audit skills.