marcohefti/surfwright
skills/surfwright/SKILL.md
Use SurfWright CLI for deterministic browser control. Prefer JSON, explicit handles, and typed error codes.
tools
Updated Apr 7, 2026
$ install --global
skillsauthnpx skillsauth add marcohefti/surfwright surfwrightInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 7, 2026, 2:50 AM137.3s3 files scanned
SKILL.md
- name:
- surfwright
- description:
- Use SurfWright CLI for deterministic browser control. Prefer JSON, explicit handles, and typed error codes.
SurfWright Skill
Deterministic browser control with JSON-first outputs and explicit handles.
Discovery (Two Lanes)
- Action first: run mission commands directly.
- Fast lane bootstrap:
surfwright contract --profile browser-core. - Do not probe with
which, help flags, or repeated skill file reads. - Use
surfwright contract --command <id>only after a command-id miss. - Use
surfwright contract --commands <id1,id2,...>for small miss batches. - Use
surfwright contract --fullonly for deep-lane catalog discovery.
Runtime Rules
- Keep default JSON output; do not parse prose.
- Confirm required JSON schema via
surfwright contract --command <id>only after a command-id miss. - Start headless unless explicitly instructed otherwise.
- For workspace extension workflows, verify
open/sessionpayloadappliedExtensions[*].state == runtime-installedbefore proceeding. - Treat non-zero exits as typed failures and branch on
code(retryablewhen present). - Use one unique
--agent-idper task. - Treat daemon queue overload codes (
E_DAEMON_QUEUE_TIMEOUT,E_DAEMON_QUEUE_SATURATED) as backpressure. - If daemon transport is unreachable and continuity matters, use
SURFWRIGHT_DAEMON=0. - For non-trivial plans, prefer
run --plan <file>(or--plan -) over inline--plan-json. - For complex JavaScript, prefer
target eval --script-file/--script-b64. - Prefer typed primitives over eval when possible:
target count,target attr,target click --nth,target click --count-after.
Related Skills
openclaw/taskflow
tools
VerifiedTrustedCommunity
Use when work should span one or more detached tasks but still behave like one job with a single owner context. TaskFlow is the durable flow substrate under authoring layers like Lobster, ACPX, plugins, or plain code. Keep conditional logic in the caller; use TaskFlow for flow identity, child-task linkage, waiting state, revision-checked mutations, and user-facing emergence.
357,764SKILL.mdUpdated Apr 10, 2026
openclaw/extensions/lobster
tools
VerifiedTrustedCommunity
# Lobster Lobster executes multi-step workflows with approval checkpoints. Use it when: - User wants a repeatable automation (triage, monitor, sync) - Actions need human approval before executing (send, post, delete) - Multiple tool calls should run as one deterministic operation ## When to use Lobster | User intent | Use Lobster? | | ------------------------------------------------------ | --------------------------
357,764SKILL.mdUpdated Apr 10, 2026
steipete/extensions/lobster
tools
VerifiedTrustedCommunity
# Lobster Lobster executes multi-step workflows with approval checkpoints. Use it when: - User wants a repeatable automation (triage, monitor, sync) - Actions need human approval before executing (send, post, delete) - Multiple tool calls should run as one deterministic operation ## When to use Lobster | User intent | Use Lobster? | | ------------------------------------------------------ | --------------------------
357,588SKILL.mdUpdated Apr 13, 2026
steipete/xurl
tools
VerifiedTrustedCommunity
A CLI tool for making authenticated requests to the X (Twitter) API. Use this skill when you need to post tweets, reply, quote, search, read posts, manage followers, send DMs, upload media, or interact with any X API v2 endpoint.
356,423SKILL.mdUpdated Apr 13, 2026