This skill should be used when the user asks to "run browser in container", "secure chrome", "agent browser", "에이전트 브라우저", "브라우저 컨테이너", "container chrome", "browser sandbox", "KasmVNC", "browse safely", "안전한 브라우저", or wants to run Chrome inside a Docker container with visual access for safe isolated browsing controlled by Claude Code.
How this skill is triggered — by the user, by Claude, or both
Slash command
/agent-browser-container:agent-browser-containerThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
A manager for safely running Chrome inside Docker containers with KasmVNC visual access.
A manager for safely running Chrome inside Docker containers with KasmVNC visual access. Claude Code inside the container controls Chrome via Playwright, while the host user can see and interact through a browser-based VNC interface. This prevents agent injection attacks from reaching the host system.
Script path: ${pluginDir}/scripts/browser.py
Execute the appropriate command via the Bash tool based on the user's request.
# Start a browser container in the current project
python3 ${pluginDir}/scripts/browser.py run .
# Run with a specific project path
python3 ${pluginDir}/scripts/browser.py run ~/my-project
# Open a zsh shell (without starting Claude)
python3 ${pluginDir}/scripts/browser.py run -s
# List running containers
python3 ${pluginDir}/scripts/browser.py list
# Attach a shell to a container
python3 ${pluginDir}/scripts/browser.py shell [name]
# Stop a container
python3 ${pluginDir}/scripts/browser.py stop [name]
# Stop all containers
python3 ${pluginDir}/scripts/browser.py stopall
# Remove a container + volume
python3 ${pluginDir}/scripts/browser.py rm <name>
# Full cleanup (containers + volumes + images)
python3 ${pluginDir}/scripts/browser.py clean
# Build image only
python3 ${pluginDir}/scripts/browser.py build
# Push to registry (requires BROWSER_IMAGE env var)
python3 ${pluginDir}/scripts/browser.py push
# Pull from registry
python3 ${pluginDir}/scripts/browser.py pull
Host (macOS)
+-- Browser -> http://localhost:6901 (KasmVNC web UI)
| See & interact with container Chromium
+-- CDP -> http://localhost:9222 (Chrome DevTools Protocol)
| Control Chrome programmatically from host
+-- Terminal -> docker exec -> Claude Code
Controls Chromium via Playwright/CDP (headless: false, DISPLAY=:1)
Container (Linux, --read-only)
+-- KasmVNC Server (virtual display :1, no-auth, streams to port 6901)
+-- Chromium (auto-launched with CDP on port 9222)
+-- socat (forwards 0.0.0.0:9223 -> 127.0.0.1:9222 for host CDP access)
+-- Claude Code (tmux session "claude", auto-started with --dangerously-skip-permissions)
+-- iptables firewall (allowlist + CHROME_ALLOW_ALL option)
+-- tmpfs: /tmp, /run, /home/node (writable but ephemeral)
+-- Playwright cache at /opt/ms-playwright (persistent in image layer)
+-- /downloads (bind mount to host, writable, UNTRUSTED)
headless: false--read-only FS, --cap-drop ALL, no-new-privileges, tmpfs mountsCHROME_ALLOW_ALL mode./downloads/ on the host{folder-name}-{path-hash}-browser format (e.g., myproject-a3f1c-browser)ANTHROPIC_API_KEY: Claude API key (can be used instead of OAuth)BROWSER_IMAGE: Custom image name (registry path for team sharing)CHROME_ALLOW_ALL: Set to 1 to allow all HTTP/HTTPS traffic (default: 1)python3 browser.py run . to start the containerhttp://localhost:6901 in the host browser to see KasmVNC (no password required)headless: false./downloads/ (treat as UNTRUSTED)--read-only FS prevents persistent malware--cap-drop ALL + NET_ADMIN minimizes kernel attack surfaceno-new-privileges prevents privilege escalation--pids-limit 500 prevents fork bombs--memory 4g prevents OOM attacks on host./downloads/ (treat as untrusted)docker --version)--dangerously-skip-permissions mode (safe due to container isolation)tmux attach -t claude inside the container--no-sandbox flag which is safe because the container IS the sandboxnpx claudepluginhub karohani/claude-code-imoogi --plugin agent-browser-containerControls the user's already-running Chrome via CDP to automate, scrape, test, or interact with web pages. Uses screenshots and coordinate clicks by default.
Controls local Chrome/Chromium via CDP for signed-in profiles, anonymous sessions, screenshots, console logs, network capture, form filling, uploads, downloads, and PDF export.
CLI for browser automation: navigate sites, snapshot elements for refs, fill forms, click buttons, screenshot, scrape data, test web apps. Chains commands, imports auth state.