browser-search: Web Search & Browsing Skill for AI Agents
An open-source skill giving AI agents self-hosted web search (SearXNG), browsing (Camofox), and anti-bot bypass (CloakBrowser) — free, unlimited, anti-hallucination by design.
README claims SSRF prevention, script sandbox, path validation and rate limiting, but the actual script code is not among the reviewed files, so security claims cannot be statically verified — 1. User confirmation is essentially absent and the README explicitly promotes 'zero human intervention', though the tool is described as read-only; deducted for no confirmation gate. Data flow (ports, architecture diagram, env vars) is reasonably documented — 2. API key handling is best-practice advice only, no code evidence — 1. Dependency security shows a direct contradiction: the README claims 'exact versions, no caret ranges' while package. uses ^0.5.5, ^3.0.3 etc., and CloakBrowser downloads a proprietary binary from cloakbrowser.dev — 1. External effects: the tool is deliberately designed to bypass Cloudflare/Akamai anti-bot protections, a real legal/ToS risk; documented but substantively risky — 1. No rollback mechanism described — 0. Third-party tools are properly attributed with links — 2.
Deducted for self-contradiction: the README's 'exact version pinning, no ^ ranges' claim conflicts with package. caret ranges, and 'guaranteed success on every query' is an overclaim — 1. Dependency availability is documented for all three external services (SearXNG Docker, Camofox Docker, CloakBrowser npm) with check.sh verification — 2. Failure handling is described (stack trace suppression, --verbose, FAQ troubleshooting) but no code is visible — 1.
Targets multiple agents (OpenCode, Claude Code, Cursor) with multilingual README — 2. Capability boundaries are excellent: 'What this skill does NOT do' explicitly excludes social media, downloads, and paywalls — 3. Trigger precision cannot be verified because SKILL.md itself was not provided in the reviewed files — 1. Environment fit covers Raspberry Pi, arm64, a known Windows issue, and check.sh — 2.
Information architecture is clear (diagram, service tables, file index) — 2. Install notes are exceptionally thorough, including the mandatory manual npm install after npx skills add and the common ERR_MODULE_NOT_FOUND failure — 3. Naming is consistent — 2. FAQ and command examples exist but FAQ.md content was not provided — 2. Known limitations are well recorded (Windows Pro issue #479, residual risks, out-of-scope uses) — 3. The MIT LICENSE file is complete and matches the README — 3. Only package. version 3.1.1 and a release badge; no CHANGELOG — 1. Maintenance responsibility is limited to issue/PR invitations, no maintainer commitment or update path — 1.
Output usability benefits from Readability extraction, snapshots, markdown format, and JSON search results — 2. Marginal value comes from bundling search, browsing, and anti-bot bypass with automatic escalation, though each component exists independently — 2. Cost/benefit: free self-hosted claims are consistent with the Docker/npm composition, but setup and upkeep overhead is nontrivial — 2.
Key performance claims (58 C++ patches, 0.9 reCAPTCHA score, ~92% pass rate) carry footnoted sources — 2. But sources are primarily vendor READMEs and a third-party blog, with no independent verification, and 'guaranteed success' is unsubstantiated — 1. Facts and inference are not separated: marketing metaphors and absolute claims are mixed with factual statements — 1.
- A core selling point is bypassing Cloudflare, Akamai, DataDome and other anti-bot protections; use may violate target sites' terms of service or applicable law — obtain legal review before enterprise deployment.
- The README claims exact version pinning, but package. actually uses caret ranges, creating supply-chain drift risk; pin versions and audit the lockfile before deployment.
- CloakBrowser downloads a proprietary Chromium binary from cloakbrowser.dev (non-open supply chain) with only a claimed SHA-256 check; run in an isolated environment.
- This review did not include SKILL.md or script source code, so all security claims (SSRF prevention, sandbox, rate limiting) are unverified at code level — conclusions are low-confidence.
- The author acknowledges the custom-script sandbox is incomplete (Node.js APIs remain available), and --unsafe disables both the sandbox and SSRF protection; never use it with untrusted input.
What does this agent do, and when should you use it?
browser-search is a skill package for AI agents, published by Johell1NS under the MIT license. It integrates three self-hosted components: SearXNG (a Docker metasearch engine on port 8080) for search, Camofox (a Docker container exposing a REST-API browser on port 9377) for standard browsing, and CloakBrowser (an npm Playwright-based stealth Chromium) for sites protected by Cloudflare, Akamai, DataDome, and similar systems. The workflow uses automatic three-tier escalation: the agent searches with SearXNG, browses results with Camofox, and switches to CloakBrowser when blocked. A SKILL.md file defines the commands and escalation rules, and execution is restricted to deterministic scripts to eliminate model hallucinations. It works with OpenCode, Claude Code, Cursor, and 70+ other agents, requires Node.js 20+, Docker, and npm, and has been built and tested on a Raspberry Pi.
Once installed, the agent performs web tasks in three phases. Phase 1 — search with SearXNG: run node scripts/searxng/searxng.mjs search "query" to get JSON results (titles, snippets, URLs) from Google, Bing, DuckDuckGo and more. Phase 2 — browse standard sites with Camofox: node scripts/camofox/camofox.mjs readability "URL" extracts clean article text via built-in Readability.js (~70% token savings), or use evaluate for JavaScript execution and snapshot for accessibility trees. Phase 3 — when a site is blocked by Cloudflare/Akamai, run node scripts/cloak/cloak-fetch.mjs "URL": CloakBrowser detects challenges, waits for them to resolve, and extracts content, with --proxy, --geoip, and --format markdown options. The whole flow is driven by the deterministic scripts declared in SKILL.md; the agent only chooses which tool to invoke.
- Research-oriented agent users who need to cross-verify facts across multiple search engines and want a 'search first, answer second' Deep Research mode to reduce fabricated answers.
- Developers on OpenCode or Claude Code who want their agent to search and scrape the web autonomously without API keys or subscriptions.
- Teams that need content from sites behind Cloudflare or DataDome, leveraging CloakBrowser's 58 C++ source-level patches and 0.9 reCAPTCHA v3 score.
- Individuals running agents on Raspberry Pi or low-power hardware — the project states it was built and tested there and can run 24/7 cheaply.
- Teams wanting to customize agent browsing rules: the SKILL.md is plain text and can be edited to add, remove, or adapt rules to their own workflow.
What are this agent's strengths and limitations?
- Completely free and self-hosted: no API keys, subscriptions, or rate limits — SearXNG, Camofox, and CloakBrowser all run on your machine.
- Automatic three-tier escalation: millisecond-fast SearXNG search, Camofox for ~90% of standard sites, CloakBrowser for anti-bot sites, with the agent choosing tools and zero human intervention.
- CloakBrowser carries 58 C++ source-level patches and scores 0.9 on reCAPTCHA v3 (human-level), passing Cloudflare, Turnstile, DataDome, Akamai, Imperva, PerimeterX, and DDoS-Guard checks.
- Layered security hardening: SSRF prevention (internal IPs and DNS rebinding blocked), script sandbox, path traversal protection, default 30 req/min rate limiting, plus a scripts/audit.sh audit script.
- Compatible with 70+ agents (OpenCode, Claude Code, Cursor, GitHub Copilot, etc.), and the plain-text SKILL.md is fully customizable.
- Non-trivial deployment: you must start SearXNG and Camofox Docker containers yourself and manually run npm install plus CloakBrowser binary download inside the skill directory, or smart-extract escalation fails with ERR_MODULE_NOT_FOUND.
- Supply-chain risk: CloakBrowser downloads a proprietary Chromium binary from cloakbrowser.dev (SHA-256 verified but not open source).
- Explicitly limited scope: no social media requiring login (Instagram, Facebook, TikTok, LinkedIn, Twitter/X), no file downloads, no paywall bypassing.
- CloakBrowser launches a fresh Chromium per request (~1-3s cold start each time), slower than the always-warm Camofox; a known issue on Windows Pro licenses causes the browser to exit ~10s after launch.
- Prompt injection risk remains: tooling mitigates damage but cannot prevent a fully compromised agent, and the docs recommend running in isolated environments.
How do you install or deploy this agent?
1) Install the skill definition: npx skills add Johell1NS/browser-search (works with 70+ agents including OpenCode, Claude Code, Cursor). 2) The installer does not run npm install, so manually enter the skill directory (e.g. ~/.config/opencode/skills/browser-search or project-local .agents/skills/browser-search) and run: npm install; node -e "import('cloakbrowser').then(c => c.ensureBinary())"; bash scripts/check.sh to verify. 3) Start SearXNG (bind 127.0.0.1:8080) and Camofox (127.0.0.1:9377) via Docker. Alternatively, git clone https://github.com/Johell1NS/browser-search and run the same npm install and ensureBinary commands from the repo root. Optional environment variables: CAMOFOX_API_KEY, CAMOFOX_ADMIN_KEY.
How do you use this agent?
After installation, show the README to your agent and have it read SKILL.md, scripts/cloak/cloak-fetch.mjs, scripts/setup.sh, and scripts/check.sh — the agent adapts commands to its platform. Typical invocations: search with node scripts/searxng/searxng.mjs search "query"; extract article text with node scripts/camofox/camofox.mjs readability "URL"; execute JS with camofox.mjs evaluate; for blocked sites use node scripts/cloak/cloak-fetch.mjs "URL", optionally with --proxy socks5://... --geoip or --format markdown (requires pip install markitdown). Note: SKILL.md uses OpenCode syntax (exec, node scripts); agents with other formats must convert commands before use.