Requirements
- Target platform
- OpenClaw
- Install method
- Manual import
- Extraction
- Extract archive
- Prerequisites
- OpenClaw
- Primary doc
- SKILL.md
C++ level anti-bot browser automation using Camoufox (patched Firefox) in isolated containers. Bypasses Cloudflare Turnstile, Datadome, Airbnb, Yelp. Superior to Chrome-based solutions (undetected-chromedriver, puppeteer-stealth) which only patch at JS level. Use when standard Playwright/Selenium gets blocked.
C++ level anti-bot browser automation using Camoufox (patched Firefox) in isolated containers. Bypasses Cloudflare Turnstile, Datadome, Airbnb, Yelp. Superior to Chrome-based solutions (undetected-chromedriver, puppeteer-stealth) which only patch at JS level. Use when standard Playwright/Selenium gets blocked.
Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.
I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Then review README.md for any prerequisites, environment setup, or post-install checks. Tell me what you changed and call out any manual steps you could not complete.
I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Then review README.md for any prerequisites, environment setup, or post-install checks. Summarize what changed and any follow-up checks I should run.
C++ level anti-bot evasion using Camoufox โ a custom Firefox fork with stealth patches compiled into the browser itself, not bolted on via JavaScript.
ApproachDetection LevelToolsCamoufox (this skill)C++ compiled patchesUndetectable fingerprints baked into browserundetected-chromedriverJS runtime patchesCan be detected by timing analysispuppeteer-stealthJS injectionPatches applied after page load = detectableplaywright-stealthJS injectionSame limitations Camoufox patches Firefox at the source code level โ WebGL, Canvas, AudioContext fingerprints are genuinely spoofed, not masked by JavaScript overrides that anti-bot systems can detect.
C++ Level Stealth โ Fingerprint spoofing compiled into the browser, not JS hacks Container Isolation โ Runs in distrobox, keeping your host system clean Dual-Tool Approach โ Camoufox for browsers, curl_cffi for API-only (no browser overhead) Firefox-Based โ Less fingerprinted than Chrome (everyone uses Chrome for bots)
Standard Playwright/Selenium gets blocked Site shows Cloudflare challenge or "checking your browser" Need to scrape Airbnb, Yelp, or similar protected sites puppeteer-stealth or undetected-chromedriver stopped working You need actual stealth, not JS band-aids
ToolLevelBest ForCamoufoxC++ patchesAll protected sites - Cloudflare, Datadome, Yelp, Airbnbcurl_cffiTLS spoofingAPI endpoints only - no JS needed, very fast
All scripts run in pybox distrobox for isolation. โ ๏ธ Use python3.14 explicitly - pybox may have multiple Python versions with different packages installed.
# Install tools in pybox (use python3.14) distrobox-enter pybox -- python3.14 -m pip install camoufox curl_cffi # Camoufox browser downloads automatically on first run (~700MB Firefox fork)
Browser (Camoufox): distrobox-enter pybox -- python3.14 scripts/camoufox-fetch.py "https://example.com" --headless API only (curl_cffi): distrobox-enter pybox -- python3.14 scripts/curl-api.py "https://api.example.com/endpoint"
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ โ OpenClaw Agent โ โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค โ distrobox-enter pybox -- python3.14 scripts/xxx.py โ โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค โ pybox Container โ โ โโโโโโโโโโโโโโโ โโโโโโโโโโโโโโโ โ โ โ Camoufox โ โ curl_cffi โ โ โ โ (Firefox) โ โ (TLS spoof)โ โ โ โโโโโโโโโโโโโโโ โโโโโโโโโโโโโโโ โ โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
What: Custom Firefox build with C++ level stealth patches Pros: Best fingerprint evasion, passes Turnstile automatically Cons: ~700MB download, Firefox-based Best for: All protected sites - Cloudflare, Datadome, Yelp, Airbnb
What: Python HTTP client with browser TLS fingerprint spoofing Pros: No browser overhead, very fast Cons: No JS execution, API endpoints only Best for: Known API endpoints, mobile app reverse engineering
Datacenter IPs (AWS, DigitalOcean) = INSTANT BLOCK on Airbnb/Yelp You MUST use residential or mobile proxies: # Example proxy config proxy = "http://user:pass@residential-proxy.example.com:8080" See references/proxy-setup.md for proxy configuration.
Sites like Airbnb/Yelp use behavioral analysis. To avoid detection: Warm up: Don't hit target URL directly. Visit homepage first, scroll, click around. Mouse movements: Inject random mouse movements (Camoufox handles this). Timing: Add random delays (2-5s between actions), not fixed intervals. Session stickiness: Use same proxy IP for 10-30 min sessions, don't rotate every request.
โ ๏ธ Old --headless flag is DETECTED. Options: New Headless: Use headless="new" (Chrome 109+) Xvfb: Run headed browser in virtual display Headed: Just run headed if you can (most reliable) # Xvfb approach (Linux) Xvfb :99 -screen 0 1920x1080x24 & export DISPLAY=:99 python scripts/camoufox-fetch.py "https://example.com"
ProblemSolution"Access Denied" immediatelyUse residential proxyCloudflare challenge loopsTry Camoufox instead of NodriverBrowser crashes in pyboxInstall missing deps: sudo dnf install gtk3 libXtTLS fingerprint blockedUse curl_cffi with impersonate="chrome120"Turnstile checkbox appearsAdd mouse movement, increase wait timeModuleNotFoundError: camoufoxUse python3.14 not python or python3greenlet segfault (exit 139)Python version mismatch - use python3.14 explicitlylibstdc++.so.6 errorsNixOS lib path issue - use python3.14 in pybox
The pybox container may have multiple Python versions with separate site-packages: # Check which Python has camoufox distrobox-enter pybox -- python3.14 -c "import camoufox; print('OK')" # Wrong (may use different Python) distrobox-enter pybox -- python3.14 scripts/camoufox-session.py ... # Correct (explicit version) distrobox-enter pybox -- python3.14 scripts/camoufox-session.py ... If you get segfaults or import errors, always use python3.14 explicitly.
distrobox-enter pybox -- python3.14 scripts/camoufox-fetch.py \ "https://www.airbnb.com/rooms/12345" \ --headless --wait 10 \ --screenshot airbnb.png
distrobox-enter pybox -- python3.14 scripts/camoufox-fetch.py \ "https://www.yelp.com/biz/some-restaurant" \ --headless --wait 8 \ --output yelp.html
distrobox-enter pybox -- python3.14 scripts/curl-api.py \ "https://api.yelp.com/v3/businesses/search?term=coffee&location=SF" \ --headers '{"Authorization": "Bearer xxx"}'
Persistent sessions allow reusing authenticated state across runs without re-logging in.
# 1. Login interactively (headed browser opens) distrobox-enter pybox -- python3.14 scripts/camoufox-session.py \ --profile airbnb --login "https://www.airbnb.com/account-settings" # Complete login in browser, then press Enter to save session # 2. Reuse session in headless mode distrobox-enter pybox -- python3.14 scripts/camoufox-session.py \ --profile airbnb --headless "https://www.airbnb.com/trips" # 3. Check session status distrobox-enter pybox -- python3.14 scripts/camoufox-session.py \ --profile airbnb --status "https://www.airbnb.com"
FlagDescription--profile NAMENamed profile for session storage (required)--loginInteractive login mode - opens headed browser--headlessUse saved session in headless mode--statusCheck if session appears valid--export-cookies FILEExport cookies to JSON for backup--import-cookies FILEImport cookies from JSON file
Location: ~/.stealth-browser/profiles/<name>/ Permissions: Directory 700, files 600 Profile names: Letters, numbers, _, - only (1-63 chars)
Save: All cookies from all domains stored in browser profile Restore: Only cookies matching target URL domain are used SSO: If redirected to Google/auth domain, re-authenticate once and profile updates
The script detects session expiry using multiple signals: HTTP status: 401, 403 URL patterns: /login, /signin, /auth Title patterns: "login", "sign in", etc. Content keywords: "captcha", "verify", "authenticate" Form detection: Password input fields If detected during --headless mode, you'll see: ๐ Login wall signals: url-path, password-form Re-run with --login to refresh the session.
Since --login requires a visible browser, you need display forwarding: X11 Forwarding (Preferred): # Connect with X11 forwarding ssh -X user@server # Run login (opens browser on your local machine) distrobox-enter pybox -- python3.14 scripts/camoufox-session.py \ --profile mysite --login "https://example.com" VNC Alternative: # On server: start VNC session vncserver :1 # On client: connect to VNC vncviewer server:1 # In VNC session: run login distrobox-enter pybox -- python3.14 scripts/camoufox-session.py \ --profile mysite --login "https://example.com"
โ ๏ธ Cookies are credentials. Treat profile directories like passwords: Profile dirs have chmod 700 (owner only) Cookie exports have chmod 600 Don't share profiles or exported cookies over insecure channels Consider encrypting backups
LimitationReasonlocalStorage/sessionStorage not exportedUse browser profile instead (handles automatically)IndexedDB not portableStored in browser profile, not cookie exportNo parallel profile accessNo file locking in v1; use one process per profile
references/proxy-setup.md โ Proxy configuration guide references/fingerprint-checks.md โ What anti-bot systems check
Workflow acceleration for inboxes, docs, calendars, planning, and execution loops.
Largest current source with strong distribution and engagement signals.