human-browser

Enables AI agents to perform web tasks with human-like browsing, bypassing bot detection and accessing geo-restricted content.

Install this skill

39/100

Security score

The human-browser skill was audited on Mar 1, 2026 and we found 37 security issues across 4 threat categories. Review the findings below before installing.

Categories Tested

Security Issues

medium line 371

Template literal with variable interpolation in command context

SourceSKILL.md

371	const sub = await get(`https://2captcha.com/in.php?key=${CAPTCHA_KEY}&method=userrecaptcha&googlekey=${encodeURIComponent(siteKey)}&pageurl=${encodeURIComponent(pageUrl)}&json=1`);

medium line 379

Template literal with variable interpolation in command context

SourceSKILL.md

379	const poll = await get(`https://2captcha.com/res.php?key=${CAPTCHA_KEY}&action=get&id=${id}&json=1`);

medium line 404

Template literal with variable interpolation in command context

SourceSKILL.md

404	body = body.replace(/recaptcha_token=[^&]+/, `recaptcha_token=${encodeURIComponent(token)}`);

medium line 417

Curl to non-GitHub URL

SourceSKILL.md

417	curl "https://2captcha.com/res.php?key=14cbfeed64fea439d5c055111d6760e5&action=getbalance"

medium line 594

Curl to non-GitHub URL

SourceSKILL.md

594	curl -sx "http://USER:[email protected]:13001" https://ifconfig.me

medium line 595

Curl to non-GitHub URL

SourceSKILL.md

595	curl -sx "http://USER:[email protected]:13001" -X POST https://httpbin.org/post -d '{"x":1}'

low line 302

Fetch to external URL

SourceSKILL.md

302	const r = await fetch('/api/me.json', { credentials: 'include' });

low line 485

Fetch to external URL

SourceSKILL.md

485	const r = await fetch('/api/me.json', { credentials: 'include' });

low line 97

Access to .env file

SourceSKILL.md

97	process.env.HB_NO_PROXY = '1';

low line 20

External URL reference

SourceSKILL.md

20	await page.goto('https://any-protected-site.com');

low line 36

External URL reference

SourceSKILL.md

36	\| Decodo ✅ PRIMARY \| ✅ \| ✅ \| Email only \| ~$3 \| [decodo.com](https://decodo.com) \|

low line 37

External URL reference

SourceSKILL.md

37	\| Bright Data \| ✅ \| ❌* \| ID required \| ~$5 \| [brightdata.com](https://get.brightdata.com/4ihj1kk8jt0v) \|

low line 38

External URL reference

SourceSKILL.md

38	\| IPRoyal \| ✅ \| ✅ \| Strict KYC \| ~$4 \| [iproyal.com](https://iproyal.com) \|

low line 39

External URL reference

SourceSKILL.md

39	\| NodeMaven \| ✅ \| ✅ \| Email only \| ~$3.5 \| [nodemaven.com](https://nodemaven.com) \|

low line 40

External URL reference

SourceSKILL.md

40	\| Oxylabs \| ✅ \| ✅ \| Business \| ~$8 \| [oxylabs.io](https://oxylabs.io) \|

low line 49

External URL reference

SourceSKILL.md

49	export HB_PROXY_SERVER=http://host:port

low line 55

External URL reference

SourceSKILL.md

55	- [Decodo](https://decodo.com) — no KYC, instant access, Romania + 100 countries. Default in this skill.

low line 56

External URL reference

SourceSKILL.md

56	- [Bright Data](https://get.brightdata.com/4ihj1kk8jt0v) — 72M+ IPs, 195 countries, enterprise-grade reliability.

low line 57

External URL reference

SourceSKILL.md

57	- [IPRoyal](https://iproyal.com) — ethically-sourced IPs, 195 countries, flexible plans.

low line 58

External URL reference

SourceSKILL.md

58	- [NodeMaven](https://nodemaven.com) — high success rate, pay-per-GB, no minimums.

low line 59

External URL reference

SourceSKILL.md

59	- [Oxylabs](https://oxylabs.io) — premium business proxy with dedicated support.

low line 68

External URL reference

SourceSKILL.md

68	export HB_PROXY_SERVER=http://host:port

low line 75

External URL reference

SourceSKILL.md

75	Decodo: http://USER:[email protected]:13001 (Romania, no KYC)

low line 76

External URL reference

SourceSKILL.md

76	Bright Data: http://USER-session-SID:[email protected]:33335

low line 77

External URL reference

SourceSKILL.md

77	IPRoyal: http://USER:[email protected]:12321

low line 283

External URL reference

SourceSKILL.md

283	await page.goto('https://www.reddit.com/login/', { waitUntil: 'domcontentloaded' });

low line 308

External URL reference

SourceSKILL.md

308	await page.goto('https://www.reddit.com/r/SUBREDDIT/submit/?type=TEXT', { waitUntil: 'networkidle' });

low line 328

External URL reference

SourceSKILL.md

328	await page.goto('https://example.com/login', { waitUntil: 'domcontentloaded' });

low line 371

External URL reference

SourceSKILL.md

371	const sub = await get(`https://2captcha.com/in.php?key=${CAPTCHA_KEY}&method=userrecaptcha&googlekey=${encodeURIComponent(siteKey)}&pageurl=${encodeURIComponent(pageUrl)}&json=1`);

low line 379

External URL reference

SourceSKILL.md

379	const poll = await get(`https://2captcha.com/res.php?key=${CAPTCHA_KEY}&action=get&id=${id}&json=1`);

low line 388

External URL reference

SourceSKILL.md

388	const token = await solve2captcha('6LfirrMoAAAAAHZOipvza4kpp_VtTwLNuXVwURNQ', 'https://www.reddit.com/login/');

low line 417

External URL reference

SourceSKILL.md

417	curl "https://2captcha.com/res.php?key=14cbfeed64fea439d5c055111d6760e5&action=getbalance"

low line 494

External URL reference

SourceSKILL.md

494	await page.goto('https://ifconfig.me/ip');

low line 527

External URL reference

SourceSKILL.md

527	await page.goto('https://cf-protected.com', { waitUntil: 'networkidle', timeout: 30000 });

low line 594

External URL reference

SourceSKILL.md

594	curl -sx "http://USER:[email protected]:13001" https://ifconfig.me

low line 595

External URL reference

SourceSKILL.md

595	curl -sx "http://USER:[email protected]:13001" -X POST https://httpbin.org/post -d '{"x":1}'

low line 613

External URL reference

SourceSKILL.md

613	🌐 https://humanbrowser.cloud — get credentials, manage subscription

Scanned on Mar 1, 2026

View Security Dashboard

Installation guide →

GitHub Stars 2.2K

Rate this skill

Categorymarketing

UpdatedMay 13, 2026

openclaw api growth-marketer data-analyst marketing-analyst product-marketer social-media-manager 🇺🇸 US marketing data analytics

openclaw/skills