mirror of
https://github.com/browserbase/skills.git
synced 2026-09-14 16:30:58 +08:00
Shrey Pandya
6811ca3116
* [codex] Add source-integrated WebMCP skill * fix: address review comments (autofix loop #1) Addresses feedback from Cursor Bugbot and Socket Security * feat: add adversarial verification step and default local runs to headed Step 5 proves a tool is discoverable and that its executor ran, not that it did what it claimed. Add step 6: probe schema closure, required fields, types and constraints, error honesty, annotation honesty, clean rejection, and consequential gating against the live page, then verify the effect in the application rather than trusting the return value. Also: - Default --local validation to headed so the browser is visible; add --headless for CI and unattended runs. - Record that document.modelContext is the live accessor while navigator.modelContext is undefined, so the fallback is load-bearing. - Record that registerTool is idempotent by name with no unregister handle, which is what makes remount and hot reload safe. - Require handlers to read results back from application state instead of echoing the request, including polling asynchronous stores until they settle. * fix: run the scanner when invoked through a symlinked skill path The self-invocation guard compared path.resolve(process.argv[1]) against fileURLToPath(import.meta.url). path.resolve normalizes . and .. but does not resolve symlinks, so when the skill is installed as a link the two paths never match, main() never runs, and the scanner prints nothing and exits 0. That is the default install shape for a Claude Code user, whose skill directory is a symlink to the real one, and step 1 points them at exactly that path. Resolve symlinks on both sides before comparing. Also tell the skill to report what each step found as it goes, rather than saving everything for the final report. * docs: validate against localhost rather than 127.0.0.1 Dev servers commonly bind localhost only, so validating against http://127.0.0.1:PORT discovers zero tools while http://localhost:PORT works. The examples recommended the address that fails, and the symptom is indistinguishable from tools never registering. Point the examples at localhost and say what zero discovered tools usually means.