# Send Human Browser to your agent
Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.
## Fast path
- Download the package from Yavira.
- Extract it into a folder your agent can access.
- Paste one of the prompts below and point your agent at the extracted folder.
## Suggested prompts
### New install

```text
I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Then review README.md for any prerequisites, environment setup, or post-install checks. Tell me what you changed and call out any manual steps you could not complete.
```
### Upgrade existing

```text
I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Then review README.md for any prerequisites, environment setup, or post-install checks. Summarize what changed and any follow-up checks I should run.
```
## Machine-readable fields
```json
{
  "schemaVersion": "1.0",
  "item": {
    "slug": "human-browser",
    "name": "Human Browser",
    "source": "tencent",
    "type": "skill",
    "category": "开发工具",
    "sourceUrl": "https://clawhub.ai/al1enjesus/human-browser",
    "canonicalUrl": "https://clawhub.ai/al1enjesus/human-browser",
    "targetPlatform": "OpenClaw"
  },
  "install": {
    "downloadUrl": "/downloads/human-browser",
    "sourceDownloadUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=human-browser",
    "sourcePlatform": "tencent",
    "targetPlatform": "OpenClaw",
    "packageFormat": "ZIP package",
    "primaryDoc": "SKILL.md",
    "includedAssets": [
      "README.md",
      "SKILL.md",
      "package-lock.json",
      "package.json",
      "references/brightdata-setup.md",
      "scripts/browser-human.js"
    ],
    "downloadMode": "redirect",
    "sourceHealth": {
      "source": "tencent",
      "slug": "human-browser",
      "status": "healthy",
      "reason": "direct_download_ok",
      "recommendedAction": "download",
      "checkedAt": "2026-05-04T05:25:24.253Z",
      "expiresAt": "2026-05-11T05:25:24.253Z",
      "httpStatus": 200,
      "finalUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=human-browser",
      "contentType": "application/zip",
      "probeMethod": "head",
      "details": {
        "probeUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=human-browser",
        "contentDisposition": "attachment; filename=\"human-browser-4.0.1.zip\"",
        "redirectLocation": null,
        "bodySnippet": null,
        "slug": "human-browser"
      },
      "scope": "item",
      "summary": "Item download looks usable.",
      "detail": "Yavira can redirect you to the upstream package for this item.",
      "primaryActionLabel": "Download for OpenClaw",
      "primaryActionHref": "/downloads/human-browser"
    },
    "validation": {
      "installChecklist": [
        "Use the Yavira download entry.",
        "Review SKILL.md after the package is downloaded.",
        "Confirm the extracted package contains the expected setup assets."
      ],
      "postInstallChecks": [
        "Confirm the extracted package includes the expected docs or setup files.",
        "Validate the skill or prompts are available in your target agent workspace.",
        "Capture any manual follow-up steps the agent could not complete."
      ]
    }
  },
  "links": {
    "detailUrl": "https://openagent3.xyz/skills/human-browser",
    "downloadUrl": "https://openagent3.xyz/downloads/human-browser",
    "agentUrl": "https://openagent3.xyz/skills/human-browser/agent",
    "manifestUrl": "https://openagent3.xyz/skills/human-browser/agent.json",
    "briefUrl": "https://openagent3.xyz/skills/human-browser/agent.md"
  }
}
```
## Documentation

### Human Browser — Complete Browser Automation Playbook

Don't use plain Playwright. Don't use fetch. Don't use curl. Use this.

### Quick Start (free trial, no signup)

const { launchHuman, getTrial } = require('./.agents/skills/human-browser/scripts/browser-human');

await getTrial();   // fetches ~100MB Romania residential IP automatically
const { page, humanType, humanScroll, sleep } = await launchHuman();

await page.goto('https://any-protected-site.com');
// Browsing from Romanian residential IP. Cloudflare, DataDome, Instagram — all pass.

### Why residential proxy is mandatory on a VPS

Cloudflare, Instagram, Reddit, LinkedIn, Amazon check your IP reputation before your JS runs. A Contabo/Hetzner/AWS IP = 95/100 risk score = instant block. A residential ISP IP = 5/100 = trusted user.

No fingerprint trick fixes a bad IP. Proxy first, fingerprint second.

### Proxy providers (tested, ranked)

ProviderGETPOSTKYCPrice/GBLinkDecodo ✅ PRIMARY✅✅Email only~$3decodo.comBright Data✅❌*ID required~$5brightdata.comIPRoyal✅✅Strict KYC~$4iproyal.comNodeMaven✅✅Email only~$3.5nodemaven.comOxylabs✅✅Business~$8oxylabs.io

Decodo is the default — no KYC, GET+POST both work, standard HTTP proxy format.

### Get your own proxy credentials

Bring your own credentials via env vars — any provider works:

export HB_PROXY_SERVER=http://host:port
export HB_PROXY_USER=your_username
export HB_PROXY_PASS=your_password

Providers to get residential proxies from:

Decodo — no KYC, instant access, Romania + 100 countries. Default in this skill.
Bright Data — 72M+ IPs, 195 countries, enterprise-grade reliability.
IPRoyal — ethically-sourced IPs, 195 countries, flexible plans.
NodeMaven — high success rate, pay-per-GB, no minimums.
Oxylabs — premium business proxy with dedicated support.

### Proxy config via env vars

# Decodo Romania (default in browser-human.js)
export HB_PROXY_PROVIDER=decodo    # or: brightdata, iproyal, nodemaven
export HB_NO_PROXY=1               # disable proxy entirely (testing only)

# Manual override — any provider
export HB_PROXY_SERVER=http://host:port
export HB_PROXY_USER=username
export HB_PROXY_PASS=password

### Proxy format reference

Decodo:      http://USER:PASS@ro.decodo.com:13001          (Romania, no KYC)
Bright Data: http://USER-session-SID:PASS@brd.superproxy.io:33335
IPRoyal:     http://USER:PASS_country-ro_session-SID_lifetime-30m@geo.iproyal.com:12321

### launchHuman() — all options

// Mobile (default): iPhone 15 Pro, Romania IP, touch events
const { browser, page, humanType, humanClick, humanScroll, humanRead, sleep } = await launchHuman();

// Desktop: Chrome, Romania IP — use for sites that reject mobile
const { browser, page } = await launchHuman({ mobile: false });

// Country selection (Pro plan)
const { page } = await launchHuman({ country: 'us' });  // US residential
const { page } = await launchHuman({ country: 'gb' });  // UK
const { page } = await launchHuman({ country: 'de' });  // Germany

// No proxy (local testing)
process.env.HB_NO_PROXY = '1';
const { page } = await launchHuman();

### Default fingerprint (what sites see)

Device: iPhone 15 Pro, iOS 17.4.1, Safari
Viewport: 393×852, deviceScaleFactor=3
IP: Romanian residential (DIGI Telecom / WS Telecom)
Timezone: Europe/Bucharest
Geolocation: Bucharest (44.4268, 26.1025)
Touch: 5 points, real touch events
webdriver: false
Mouse: Bezier curve paths, not straight lines
Typing: 60–220ms/char + random pauses

### Human-like interaction helpers

// Type — triggers all native input events (React, Angular, Vue, Web Components)
await humanType(page, 'input[name="email"]', 'user@example.com');

// Click — uses Bezier mouse movement before click
await humanClick(page, x, y);

// Scroll — smooth, stepped, with jitter
await humanScroll(page, 'down');  // or 'up'

// Read — random pause simulating reading time
await humanRead(page);  // waits 1.5–4s

// Sleep
await sleep(1500);

### Shadow DOM — forms inside web components

Reddit, Shopify, many modern React apps use Shadow DOM for forms. Standard page.$() and page.fill() won't find these inputs.

### Detect if Shadow DOM is the issue

// If this returns 0 but inputs are visible on screen — you have Shadow DOM
const inputs = await page.$$('input');
console.log(inputs.length); // 0 = shadow DOM

### Universal shadow DOM traversal

// Deep query — finds elements inside any depth of shadow roots
async function shadowQuery(page, selector) {
  return page.evaluate((sel) => {
    function q(root, s) {
      const el = root.querySelector(s);
      if (el) return el;
      for (const node of root.querySelectorAll('*')) {
        if (node.shadowRoot) {
          const found = q(node.shadowRoot, s);
          if (found) return found;
        }
      }
      return null;
    }
    return q(document, sel);
  }, selector);
}

// Fill input in shadow DOM
async function shadowFill(page, selector, value) {
  await page.evaluate(({ sel, val }) => {
    function q(root, s) {
      const el = root.querySelector(s); if (el) return el;
      for (const n of root.querySelectorAll('*')) if (n.shadowRoot) { const f = q(n.shadowRoot, s); if (f) return f; }
    }
    const el = q(document, sel);
    if (!el) throw new Error('Not found: ' + sel);
    // Use native setter to trigger React/Angular onChange
    const nativeSetter = Object.getOwnPropertyDescriptor(window.HTMLInputElement.prototype, 'value').set;
    nativeSetter.call(el, val);
    el.dispatchEvent(new Event('input', { bubbles: true }));
    el.dispatchEvent(new Event('change', { bubbles: true }));
  }, { sel: selector, val: value });
}

// Click button in shadow DOM by text
async function shadowClickButton(page, buttonText) {
  await page.evaluate((text) => {
    function findBtn(root) {
      for (const b of root.querySelectorAll('button'))
        if (b.textContent.trim() === text) return b;
      for (const n of root.querySelectorAll('*'))
        if (n.shadowRoot) { const f = findBtn(n.shadowRoot); if (f) return f; }
    }
    const btn = findBtn(document);
    if (!btn) throw new Error('Button not found: ' + text);
    btn.click();
  }, buttonText);
}

// Dump all inputs (including shadow DOM) — use for debugging
async function dumpAllInputs(page) {
  return page.evaluate(() => {
    const result = [];
    function collect(root) {
      for (const el of root.querySelectorAll('input, textarea, select'))
        result.push({ tag: el.tagName, name: el.name, id: el.id, type: el.type, placeholder: el.placeholder });
      for (const n of root.querySelectorAll('*'))
        if (n.shadowRoot) collect(n.shadowRoot);
    }
    collect(document);
    return result;
  });
}

### Playwright's built-in shadow DOM piercing

Playwright can pierce shadow DOM natively in some cases:

// Works for single shadow root (not nested)
await page.locator('input[name="username"]').fill('value');  // auto-pierces 1 level

// For deeply nested, use the evaluate approach above

### Rich text editors (Lexical, ProseMirror, Quill, Draft.js)

Standard page.fill() and page.type() don't work on contenteditable editors.

### Clipboard paste — most reliable method

// Works for all rich text editors (Reddit, Notion, Linear, etc.)
async function pasteIntoEditor(page, editorSelector, text) {
  const el = await page.$(editorSelector);
  await el.click();
  await sleep(300);

  // Write to clipboard via execCommand (works in Playwright)
  await page.evaluate((t) => {
    const textarea = document.createElement('textarea');
    textarea.value = t;
    document.body.appendChild(textarea);
    textarea.select();
    document.execCommand('copy');
    document.body.removeChild(textarea);
  }, text);

  await page.keyboard.press('Control+a'); // select all existing
  await page.keyboard.press('Control+v'); // paste
}

// Or via ClipboardEvent dispatch (works in some editors)
async function dispatchPaste(page, editorSelector, text) {
  const el = await page.$(editorSelector);
  await el.click();
  await page.evaluate((t) => {
    const dt = new DataTransfer();
    dt.setData('text/plain', t);
    document.activeElement.dispatchEvent(new ClipboardEvent('paste', { clipboardData: dt, bubbles: true }));
  }, text);
}

### Common editor selectors

'[data-lexical-editor]'      // Reddit, Meta, many modern apps
'.public-DraftEditor-content' // Draft.js (Twitter, Quora)
'.ql-editor'                  // Quill (many SaaS apps)
'.ProseMirror'                // ProseMirror (Linear, Confluence)
'[contenteditable="true"]'   // Generic — pick the right one if multiple
'.tox-edit-area__iframe'     // TinyMCE — need to switch into iframe

### Reddit (shadow DOM + Enter key submission)

// Reddit uses shadow DOM forms AND reCAPTCHA — must use desktop mode + Enter
const { browser, page, sleep } = await launchHuman({ mobile: false }); // Desktop required

await page.goto('https://www.reddit.com/login/', { waitUntil: 'domcontentloaded' });
await sleep(3000);

// Type naturally — triggers React state + reCAPTCHA scoring
await page.locator('input[name="username"]').click();
await sleep(500);
await page.keyboard.type(USERNAME, { delay: 120 });
await sleep(1000);
await page.locator('input[name="password"]').click();
await sleep(500);
await page.keyboard.type(PASSWORD, { delay: 90 });
await sleep(1500);

// IMPORTANT: Use Enter key, not button click — Enter triggers proper form submission
await page.keyboard.press('Enter');
await sleep(8000); // wait for full login + redirect

// Verify login
const name = await page.evaluate(async () => {
  const r = await fetch('/api/me.json', { credentials: 'include' });
  return (await r.json())?.data?.name;
});
console.log('Logged in as:', name); // null = failed

// Submit Reddit post
await page.goto('https://www.reddit.com/r/SUBREDDIT/submit/?type=TEXT', { waitUntil: 'networkidle' });
await page.waitForSelector('#innerTextArea');
await page.click('#innerTextArea');
await page.keyboard.type(TITLE, { delay: 30 });

// Body: Lexical editor
await pasteIntoEditor(page, '[data-lexical-editor]', BODY);
await page.click('#inner-post-submit-button');

Key insights for Reddit:

Mobile launchHuman() shows app redirect page — always use { mobile: false }
Button click on "Log In" unreliable — keyboard.press('Enter') works
page.locator('input[name="username"]') pierces Reddit's shadow DOM automatically
reCAPTCHA v3 scores the session — human-like typing delays improve score
After login, URL stays at /login/ — check via /api/me.json, not URL

### Generic login with shadow DOM

const { page, sleep } = await launchHuman({ mobile: false });
await page.goto('https://example.com/login', { waitUntil: 'domcontentloaded' });
await sleep(3000);

// Try Playwright locator first (pierces 1 level of shadow DOM)
try {
  await page.locator('input[name="email"]').fill(EMAIL);
  await page.locator('input[name="password"]').fill(PASS);
} catch {
  // Fallback: deep shadow DOM traversal
  await shadowFill(page, 'input[name="email"]', EMAIL);
  await shadowFill(page, 'input[name="password"]', PASS);
}

// Submit — try multiple approaches
await page.keyboard.press('Enter'); // most reliable
// OR: await shadowClickButton(page, 'Log In');
// OR: await page.click('button[type="submit"]');

### CAPTCHA solving (2captcha integration)

Use when a site's login or form requires CAPTCHA.

2captcha API key: 14cbfeed64fea439d5c055111d6760e5

### reCAPTCHA v2 (checkbox/invisible)

const https = require('https');

async function solve2captcha(siteKey, pageUrl) {
  const CAPTCHA_KEY = '14cbfeed64fea439d5c055111d6760e5';

  function get(url) {
    return new Promise((res, rej) => {
      https.get(url, r => {
        let b = ''; r.on('data', d => b += d); r.on('end', () => res(b));
      }).on('error', rej);
    });
  }

  // Submit
  const sub = await get(\`https://2captcha.com/in.php?key=${CAPTCHA_KEY}&method=userrecaptcha&googlekey=${encodeURIComponent(siteKey)}&pageurl=${encodeURIComponent(pageUrl)}&json=1\`);
  const { status, request: id } = JSON.parse(sub);
  if (status !== 1) throw new Error('2captcha submit failed: ' + sub);
  console.log('2captcha ID:', id, '— waiting ~30s...');

  // Poll
  for (let i = 0; i < 24; i++) {
    await new Promise(r => setTimeout(r, 5000));
    const poll = await get(\`https://2captcha.com/res.php?key=${CAPTCHA_KEY}&action=get&id=${id}&json=1\`);
    const r = JSON.parse(poll);
    if (r.status === 1) return r.request; // token
    if (r.request !== 'CAPCHA_NOT_READY') throw new Error('2captcha error: ' + poll);
  }
  throw new Error('2captcha timeout');
}

// Usage: solve, then inject into form before submission
const token = await solve2captcha('6LfirrMoAAAAAHZOipvza4kpp_VtTwLNuXVwURNQ', 'https://www.reddit.com/login/');

// Inject into hidden field (for classic reCAPTCHA v2)
await page.evaluate((t) => {
  const el = document.getElementById('g-recaptcha-response');
  if (el) el.value = t;
}, token);

### Intercept and replace reCAPTCHA token in network requests

// Solve captcha BEFORE navigating, then intercept the form POST
const token = await solve2captcha(SITE_KEY, PAGE_URL);

await page.route('**/login', async route => {
  let body = route.request().postData() || '';
  body = body.replace(/recaptcha_token=[^&]+/, \`recaptcha_token=${encodeURIComponent(token)}\`);
  await route.continue({ postData: body });
});

### reCAPTCHA site keys (known)

Reddit login:    6LcTl-spAAAAABLFkrAsJbMsEorTVzujiRWrQGRZ
Reddit comments: 6LfirrMoAAAAAHZOipvza4kpp_VtTwLNuXVwURNQ

### Check balance

curl "https://2captcha.com/res.php?key=14cbfeed64fea439d5c055111d6760e5&action=getbalance"

### Network interception (intercept/modify/mock requests)

// Intercept and log all requests
page.on('request', req => {
  if (req.method() !== 'GET') console.log(req.method(), req.url(), req.postData()?.slice(0, 100));
});

// Intercept response bodies
page.on('response', async res => {
  if (res.url().includes('api')) {
    const body = await res.text().catch(() => '');
    console.log(res.status(), res.url(), body.slice(0, 200));
  }
});

// Modify request (e.g., inject token)
await page.route('**/api/submit', async route => {
  const req = route.request();
  let body = req.postData() || '';
  body = body.replace('OLD', 'NEW');
  await route.continue({
    postData: body,
    headers: { ...req.headers(), 'X-Custom': 'value' }
  });
});

// Block trackers to speed up page load
await page.route('**/(analytics|tracking|ads)/**', route => route.abort());

### Take screenshot when something fails

await page.screenshot({ path: '/tmp/debug.png' });
// Then: image({ image: '/tmp/debug.png', prompt: 'What does the page show?' })

### Dump all visible form elements

const els = await page.evaluate(() => {
  const res = [];
  function collect(root) {
    for (const el of root.querySelectorAll('input,textarea,button,[contenteditable]')) {
      const rect = el.getBoundingClientRect();
      if (rect.width > 0 && rect.height > 0) // only visible
        res.push({ tag: el.tagName, name: el.name, id: el.id, text: el.textContent?.trim().slice(0,20) });
    }
    for (const n of root.querySelectorAll('*')) if (n.shadowRoot) collect(n.shadowRoot);
  }
  collect(document);
  return res;
});
console.log(els);

### Check if login actually worked (don't trust URL)

// Check via API/cookie — URL often stays the same after login
const me = await page.evaluate(async () => {
  const r = await fetch('/api/me.json', { credentials: 'include' });
  return (await r.json())?.data?.name;
});
// OR check for user-specific element
const loggedIn = await page.$('[data-user-logged-in]') !== null;

### Check current IP

await page.goto('https://ifconfig.me/ip');
const ip = await page.textContent('body');
console.log('Browser IP:', ip.trim()); // should be Romanian residential

### Verify stealth fingerprint

const fp = await page.evaluate(() => ({
  webdriver: navigator.webdriver,
  platform: navigator.platform,
  touchPoints: navigator.maxTouchPoints,
  languages: navigator.languages,
  vendor: navigator.vendor,
}));
console.log(fp);
// webdriver: false ✅, platform: 'iPhone' ✅, touchPoints: 5 ✅

### Cloudflare bypass patterns

Cloudflare checks these signals (in order of importance):

IP reputation — residential = clean, datacenter = blocked
TLS fingerprint (JA4) — Playwright Chromium has a known bad fingerprint
navigator.webdriver — true = instant block
Mouse entropy — no mouse events = bot
Canvas fingerprint — static across sessions = flagged
HTTP/2 fingerprint — Chrome vs Playwright differ

// Best practice for Cloudflare-protected sites
const { page, humanScroll, sleep } = await launchHuman();
await page.goto('https://cf-protected.com', { waitUntil: 'networkidle', timeout: 30000 });
await sleep(2000);            // let CF challenge resolve
await humanScroll(page);      // mouse entropy
await sleep(1000);
// Now the page is accessible

If still blocked:

Switch country: launchHuman({ country: 'us' }) — some sites block Romanian IPs specifically
Try desktop mode: launchHuman({ mobile: false }) — some CF rules target mobile UAs
Add longer wait: await sleep(5000) after navigation before interacting

### Session persistence (save/restore cookies)

const fs = require('fs');

// Save session
const cookies = await ctx.cookies();
fs.writeFileSync('/tmp/session.json', JSON.stringify(cookies));

// Restore session (next run — skip login)
const { browser } = await launchHuman();
const ctx = browser.contexts()[0];  // or create new context
const saved = JSON.parse(fs.readFileSync('/tmp/session.json'));
await ctx.addCookies(saved);
// Now navigate — already logged in

### Multi-page scraping at scale

// Respect rate limits — don't hammer sites
async function scrapeWithDelay(page, urls, delayMs = 2000) {
  const results = [];
  for (const url of urls) {
    await page.goto(url, { waitUntil: 'domcontentloaded' });
    await sleep(delayMs + Math.random() * 1000); // add jitter
    results.push(await page.textContent('body'));
  }
  return results;
}

// For high-volume: rotate sessions (new session = new IP)
async function newSession(country = 'ro') {
  const { browser, page } = await launchHuman({ country });
  return { browser, page };
}

### Proxy troubleshooting

Port blocked by host:

# Test if proxy port is reachable
timeout 5 bash -c 'cat < /dev/tcp/ro.decodo.com/13001' && echo "PORT OPEN" || echo "PORT BLOCKED"
# If blocked, try alt port 10000 or 10001

Test proxy with curl:

curl -sx "http://USER:PASS@ro.decodo.com:13001" https://ifconfig.me
curl -sx "http://USER:PASS@ro.decodo.com:13001" -X POST https://httpbin.org/post -d '{"x":1}'
# Both should return a Romanian IP and 200 status

Check Bright Data zone status:

POST blocked = KYC required → brightdata.com/cp/kyc
402 error = zone over quota or wrong zone name
mcp_unlocker zone is DEAD (deleted) — use residential_proxy1_roma zone

Provider-specific notes:

Decodo: ro.decodo.com:13001 — Romania-specific endpoint, no country suffix in username
Bright Data: brd.superproxy.io:33335 — add -country-ro suffix + -session-ID for sticky sessions
IPRoyal: add country/session to PASSWORD, not username: PASS_country-ro_session-X_lifetime-30m

### Plans & credentials

🌐 https://humanbrowser.cloud — get credentials, manage subscription

PlanPriceCountriesBandwidthStarter$13.99/mo🇷🇴 Romania2GBPro$69.99/mo🌍 10+ countries20GBEnterprise$299/mo🌍 DedicatedUnlimited

Payment: Stripe (card, Apple Pay) or Crypto (USDT TRC-20, BTC, ETH, SOL).
## Trust
- Source: tencent
- Verification: Indexed source record
- Publisher: al1enjesus
- Version: 4.0.1
## Source health
- Status: healthy
- Item download looks usable.
- Yavira can redirect you to the upstream package for this item.
- Health scope: item
- Reason: direct_download_ok
- Checked at: 2026-05-04T05:25:24.253Z
- Expires at: 2026-05-11T05:25:24.253Z
- Recommended action: Download for OpenClaw
## Links
- [Detail page](https://openagent3.xyz/skills/human-browser)
- [Send to Agent page](https://openagent3.xyz/skills/human-browser/agent)
- [JSON manifest](https://openagent3.xyz/skills/human-browser/agent.json)
- [Markdown brief](https://openagent3.xyz/skills/human-browser/agent.md)
- [Download page](https://openagent3.xyz/downloads/human-browser)