Build local constrained-browser agents with a safe_browser tool that owns CDP, enforces a domain allowlist with Fetch interception, and lets a runtime Claude Agent SDK agent complete browsing tasks without raw browser, shell, or CDP access. Use when the user wants an agent to browse or scrape while staying on approved domains, demo blocked off-domain navigation, or generate a safe browser client.
Safe Browser is a builder guide for creating local, constrained browser-agent demos in which the generated runtime agent has exactly one browser capability: a `safe_browser` tool. That tool owns the Playwright/CDP session, enables Fetch interception for all requests, and fails any request whose host is not on an allowlist. The skill exists to solve a containment problem — letting an autonomous agent browse or scrape while provably staying on approved domains, and demonstrating how prompt-injection or link-following can be blocked at the network layer rather than trusted to the model.
The default path scaffolds a Claude Agent SDK local template (a Hacker News scraper demo) that runs against local Chromium. Its design rules deliberately expose only constrained actions — goto, extract_front_page, extract_comments, current_url, and audit_log — and forbid raw CDP passthrough so the agent cannot disable Fetch interception, create targets, attach new sessions, or run arbitrary shell. Verification is central: a passing demo must show the agent loading Hacker News, extracting a story, visiting an internal comments page, attempting an off-domain URL, and having that request paused and failed by the firewall while the browser URL stays on the allowlisted host, with a result, audit log, and screenshot written as artifacts.
Target users are developers building browser or scraping agents that must obey a domain policy, and security-minded engineers who want to demonstrate link-following or injection containment. It requires Node.js 18+, npm, a local Chromium install via Playwright, and an ANTHROPIC_API_KEY for the generated runtime app.
It owns the CDP session and enables Fetch interception for all requests. Allowed hosts are continued via Fetch.continueRequest; blocked hosts are rejected via Fetch.failRequest. The agent only sees constrained actions, never raw CDP method/params passthrough.
Node.js 18+, npm, and a local Chromium installed with `npx playwright install chromium`. The generated Claude Agent SDK runtime app needs an ANTHROPIC_API_KEY.
It defaults to local Chromium. Browserbase remote mode is only used if the user explicitly asks for it.
Change the allowlist and replace the demo's Hacker News extractor actions with site-specific structured extractors. Purpose-built extractors are preferred over broad page snapshots because they are easier to verify and harder to misuse.
No. The skill is a builder guide; the runtime boundary is the generated Claude Agent SDK app and its safe_browser tool. Page content is treated as untrusted, and every browser action must go through safe_browser.
Quick Setup:
.claude/skills/Repository
browserbase/skills