Connect or launch

• Test the standard endpoint:

• If unavailable, inspect running browser processes and listening ports. A Chrome process without a remote-debugging endpoint cannot be attached in place.

• If the user wants you to launch a controllable instance, call get_scratchpad_folder, create a profile folder there, and launch:

• Explain that a scratchpad profile persists across immediate restarts only while that scratchpad exists. For durable use, offer a dedicated persistent profile and obtain permission before writing outside the workspace.

• Never expose the CDP port beyond loopback.

Use the bundled helper

Resolve scripts/cdp.mjs relative to this SKILL.md. It requires Node 22 or newer with built-in WebSocket and has no third-party dependencies.

node <skill-folder>/scripts/cdp.mjs list
node <skill-folder>/scripts/cdp.mjs read --target-id '<id-from-list>' --selector '#status' --limit 1000
node <skill-folder>/scripts/cdp.mjs run --target-id '<id-from-list>' --file '<scratchpad>/workflow.json'
node <skill-folder>/scripts/cdp.mjs body --target-url 'example.com/path' --limit 4000
node <skill-folder>/scripts/cdp.mjs navigate --target-url 'example.com' --url 'https://example.com/new'
node <skill-folder>/scripts/cdp.mjs new --url 'https://example.com/'
node <skill-folder>/scripts/cdp.mjs click-text --target-url 'example.com' --text 'Continue'
node <skill-folder>/scripts/cdp.mjs type --target-url 'example.com' --selector 'input[name=email]' --text 'person@example.com'
node <skill-folder>/scripts/cdp.mjs eval --target-url 'example.com' --expression 'document.title'
node <skill-folder>/scripts/cdp.mjs screenshot --target-url 'example.com' --output '/absolute/scratchpad/page.png'
node <skill-folder>/scripts/cdp.mjs clear-cookies --domains 'example.com,login.example.com'

--target-id selects an exact page ID from list. All per-page commands also accept --target-url, a case-sensitive URL substring that must match exactly one page. Supply one selector, not both. Endpoint discovery has a 10-second timeout; commands have a 30-second connection deadline (run --timeout-ms overrides it). Individual page evaluations are capped at 5 seconds.

Interaction workflow

• Run list and identify the exact page target. Reuse its ID while working on that tab.
• Inspect relevant content with read --selector CSS. If the page structure is unknown, use a bounded body once, then focused eval for labels, roles, and selectors without reading secret-field values.
• For repeated, already-understood actions, read references/workflows.md and use run with a JSON sequence of fill, click, wait-for, read, and checkpoint steps. It uses one connection and emits one compact receipt. Verify application state with waits and a small final read. Checkpoints only label progress; they do not verify success.
• Use individual commands for exploration and navigation. Batch only actions already covered by the user's authorization. Stop at unknown page state, authentication, secret entry, or a required approval; inspect before continuing.
• After a failed batch, inspect completedSteps, failedStep, and live state. Earlier writes may have succeeded. Never automatically replay the whole file; reconcile and construct only the remaining work. outcomeUnknown flags an interrupted input dispatch, not a guarantee that other failures had no effects.
• For controls outside the workflow's ordinary text inputs and buttons, inspect their state and use focused CDP mouse/key events. Keep the user informed at meaningful checkpoints.

Tabs and screenshots

• Create a new tab with new when testing a path should not disrupt the user's current page.
• Screenshots must be written to the scratchpad, not the workspace. Inspect them with view_images if needed.
• Before taking a screenshot, ensure no password, verification code, real payment credential, private key, or token is visible. Provider-published test values are allowed only under the explicit test-mode exception above.

Cookies and site data

• clear-cookies --domains deletes only matching-domain cookies and never prints cookie names or values.
• Domain matching includes subdomains of each requested domain.
• Cookie deletion does not clear local storage, IndexedDB, caches, or service workers.
• To clear all storage for an origin, use CDP Storage.clearDataForOrigin only after explaining that it can reset an unfinished flow. Keep unrelated origins untouched.
• Clearing local browser data does not remove server-side sessions, fraud flags, account state, or remote data.

Troubleshooting

• If a click does nothing, inspect whether the text belongs to a wrapper or shadow/custom element. Use the smallest visible interactive element and real mouse events.
• If typed text appears but the app does not react, focus the field and use Input.insertText; follow with appropriate key events or blur.
• If a SPA is still loading, wait and inspect again rather than repeating a submission.
• If /json/list shows a changed target ID after authentication, rediscover the target instead of reusing an old WebSocket URL.
• If authentication redirects unexpectedly, inspect the active account indicator and URL before continuing.

Connect or launch

• Test the standard endpoint:

• If unavailable, inspect running browser processes and listening ports. A Chrome process without a remote-debugging endpoint cannot be attached in place.

• If the user wants you to launch a controllable instance, call get_scratchpad_folder, create a profile folder there, and launch:

• Explain that a scratchpad profile persists across immediate restarts only while that scratchpad exists. For durable use, offer a dedicated persistent profile and obtain permission before writing outside the workspace.

• Never expose the CDP port beyond loopback.

Use the bundled helper

Resolve scripts/cdp.mjs relative to this SKILL.md. It requires Node 22 or newer with built-in WebSocket and has no third-party dependencies.

node <skill-folder>/scripts/cdp.mjs list
node <skill-folder>/scripts/cdp.mjs read --target-id '<id-from-list>' --selector '#status' --limit 1000
node <skill-folder>/scripts/cdp.mjs run --target-id '<id-from-list>' --file '<scratchpad>/workflow.json'
node <skill-folder>/scripts/cdp.mjs body --target-url 'example.com/path' --limit 4000
node <skill-folder>/scripts/cdp.mjs navigate --target-url 'example.com' --url 'https://example.com/new'
node <skill-folder>/scripts/cdp.mjs new --url 'https://example.com/'
node <skill-folder>/scripts/cdp.mjs click-text --target-url 'example.com' --text 'Continue'
node <skill-folder>/scripts/cdp.mjs type --target-url 'example.com' --selector 'input[name=email]' --text 'person@example.com'
node <skill-folder>/scripts/cdp.mjs eval --target-url 'example.com' --expression 'document.title'
node <skill-folder>/scripts/cdp.mjs screenshot --target-url 'example.com' --output '/absolute/scratchpad/page.png'
node <skill-folder>/scripts/cdp.mjs clear-cookies --domains 'example.com,login.example.com'

--target-id selects an exact page ID from list. All per-page commands also accept --target-url, a case-sensitive URL substring that must match exactly one page. Supply one selector, not both. Endpoint discovery has a 10-second timeout; commands have a 30-second connection deadline (run --timeout-ms overrides it). Individual page evaluations are capped at 5 seconds.

Interaction workflow

• Run list and identify the exact page target. Reuse its ID while working on that tab.
• Inspect relevant content with read --selector CSS. If the page structure is unknown, use a bounded body once, then focused eval for labels, roles, and selectors without reading secret-field values.
• For repeated, already-understood actions, read references/workflows.md and use run with a JSON sequence of fill, click, wait-for, read, and checkpoint steps. It uses one connection and emits one compact receipt. Verify application state with waits and a small final read. Checkpoints only label progress; they do not verify success.
• Use individual commands for exploration and navigation. Batch only actions already covered by the user's authorization. Stop at unknown page state, authentication, secret entry, or a required approval; inspect before continuing.
• After a failed batch, inspect completedSteps, failedStep, and live state. Earlier writes may have succeeded. Never automatically replay the whole file; reconcile and construct only the remaining work. outcomeUnknown flags an interrupted input dispatch, not a guarantee that other failures had no effects.
• For controls outside the workflow's ordinary text inputs and buttons, inspect their state and use focused CDP mouse/key events. Keep the user informed at meaningful checkpoints.

Tabs and screenshots

• Create a new tab with new when testing a path should not disrupt the user's current page.
• Screenshots must be written to the scratchpad, not the workspace. Inspect them with view_images if needed.
• Before taking a screenshot, ensure no password, verification code, real payment credential, private key, or token is visible. Provider-published test values are allowed only under the explicit test-mode exception above.

Cookies and site data

• clear-cookies --domains deletes only matching-domain cookies and never prints cookie names or values.
• Domain matching includes subdomains of each requested domain.
• Cookie deletion does not clear local storage, IndexedDB, caches, or service workers.
• To clear all storage for an origin, use CDP Storage.clearDataForOrigin only after explaining that it can reset an unfinished flow. Keep unrelated origins untouched.
• Clearing local browser data does not remove server-side sessions, fraud flags, account state, or remote data.

Troubleshooting

• If a click does nothing, inspect whether the text belongs to a wrapper or shadow/custom element. Use the smallest visible interactive element and real mouse events.
• If typed text appears but the app does not react, focus the field and use Input.insertText; follow with appropriate key events or blur.
• If a SPA is still loading, wait and inspect again rather than repeating a submission.
• If /json/list shows a changed target ID after authentication, rediscover the target instead of reusing an old WebSocket URL.
• If authentication redirects unexpectedly, inspect the active account indicator and URL before continuing.