RonanCodes/browser-cookies
skills/browser-cookies/SKILL.md
Extract cookies for a domain from the user's browser (Firefox, Brave, Chrome, Arc, Chromium, Edge). Reads ROBROWSER default from ~/.config/ro/defaults.env. Used by scraping skills that need an authenticated session. Supersedes firefox-cookies.
development
Updated May 1, 2026
$ install --global
skillsauthnpx skillsauth add RonanCodes/ronan-skills browser-cookiesInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 1, 2026, 2:24 AM169.7s2 files scanned
SKILL.md
- name:
- browser-cookies
- description:
- Extract cookies for a domain from the user's browser (Firefox, Brave, Chrome, Arc, Chromium, Edge). Reads ROBROWSER default from ~/.config/ro/defaults.env. Used by scraping skills that need an authenticated session. Supersedes firefox-cookies.
- category:
- infra
- argument-hint:
- <domain> [--browser brave|chrome|arc|chromium|edge|firefox|auto] [--format header|json|jar]
- allowed-tools:
- Bash(sqlite3 *) Bash(uv *) Bash(python3 *) Read Write
- - pipeline:
- scan
- - platform:
- multi
- - role:
- primitive
Browser Cookies
Pull cookies for a specific domain from the user's logged-in browser session. Supports:
- Firefox — reads
cookies.sqlitedirectly (no decryption needed) - Chromium family (Brave, Chrome, Arc, Chromium, Edge) — via
browser_cookie3, which decrypts using the macOS Keychain (prompts the first time)
Output formats: shell-safe Cookie: header (default), JSON, or a raw name/value list.
Usage
/ro:browser-cookies linkedin.com # uses ROBROWSER default (brave for this user)
/ro:browser-cookies linkedin.com --browser firefox
/ro:browser-cookies x.com --format json
Resolving the browser
Priority:
--browserflagROBROWSERfrom~/.config/ro/defaults.env- Auto-detect: first of
brave,chrome,arc,firefoxwith a cookies file for the requested domain.
Execution
Single entry point: scripts/get.py. Invoke with uv so browser_cookie3 is auto-provisioned:
uv run --with browser-cookie3 --with requests python3 \
/path/to/skills/browser-cookies/scripts/get.py <domain> [flags]
Firefox path uses stdlib only (sqlite3). Chromium path needs browser_cookie3.
Keychain prompt (first time on Chromium)
macOS will prompt: "python3 wants to use the 'Brave Safe Storage' key in your keychain." Click Always Allow. Without approval, decryption silently returns zero cookies.
Output shape
--format header (default)
Cookie: li_at=AQE...; JSESSIONID="ajax:..."; bcookie=v=2&...
One line. Safe to export COOKIE_HEADER="$(...)" and pass to curl -H.
--format json
[
{"name": "li_at", "value": "AQE...", "domain": ".linkedin.com", "expires": 1780000000}
]
--format jar
Tab-separated name<TAB>value — convenient for shell parsing.
Security
- Domain-scoped — never dumps all cookies.
- Never writes cookie values to disk. Temp Firefox DB copy deleted after reading.
- Callers must never log or commit the output.
Dependencies
- macOS only for now. Paths hardcoded to
~/Library/Application Support/.... sqlite3(Firefox path) — preinstalleduv— for auto-provisioningbrowser_cookie3. Install:brew install uv
See also
ro:firefox-cookies— narrower legacy skill (Firefox only). Deprecated; prefer this.ro:linkedin-scan,ro:linkedin-voyager— primary callers.
Related Skills
RonanCodes/skills/linear-pipeline
testing
VerifiedTrustedCommunity
--- name: linear-pipeline description: The Fable orchestrator for a single dispatched Linear ticket. Holds almost no context itself; it receives `--issue <ID> --detached`, decides the stage sequence, and fans out a sub-agent per stage, passing forward only each stage's artifact (never re-derived, never inlined into its own context). Step zero, before any planning or stage routing, is a boundary triage against `canon/security-boundary.md` (#199): a match tags Ronan Connolly and stops the run, no
SKILL.mdUpdated Jul 5, 2026
RonanCodes/skills/in-your-face
development
VerifiedTrustedCommunity
--- name: in-your-face description: Capture a chat-only answer into a durable artifact (markdown + HTML, PDF when cheap) and launch it automatically so the user cannot miss it. Use when user says "in your face", "don't let me lose this", "save that answer", "make that durable", or right after answering a substantive side question (a recipe, comparison, how-to, or generated prompt) that would otherwise die with the context. category: workflow argument-hint: [--no-open] [--vault <short>] [hint of
SKILL.mdUpdated Jul 5, 2026
RonanCodes/codex
tools
VerifiedTrustedCommunity
One-shot headless OpenAI Codex CLI calls for background/admin AI tasks — summaries, classification, extraction, admin glue. The default engine for anything that runs AI constantly in the background (daemon-driven, per-event), because it bills the flat ChatGPT subscription instead of Claude usage or per-token API spend, and it keeps working while Claude is rate-limited. NEVER for coding — coding stays Claude. Use when a skill or daemon needs a cheap always-on AI call, when the user says "use codex", "ask codex", "codex as backup", or when building a background summarizer/classifier into a listener or loop. Reads auth from ~/.codex/auth.json (ChatGPT account, no API key).
SKILL.mdUpdated Jul 5, 2026
RonanCodes/warranty-check
research
VerifiedTrustedCommunity
Turn a warranty rejection, repair quote, or RMA email into a cited decision brief — legal read (NL/EU consumer law), is the part user-serviceable, live part and new-unit prices, repair-vs-DIY-vs-new economics, before-you-send-it checklist, deadlines. Use when the user pastes or screenshots a repair quote, warranty rejection, "not covered" email, onderzoekskosten fee, or asks "should I repair or replace this".
SKILL.mdUpdated Jul 4, 2026