{
  "markdown": "\n# liarjs skills\n\n**Agent Skills for browser fingerprint testing and automation-harness QA.**\n\nFour skills that teach a coding agent to run [`liarjs`](https://www.npmjs.com/package/liarjs):\n40 consistency checks over 19 fingerprint probes, cross-checked against what the TLS/HTTP layer\nactually saw.\n\n[liarjs.dev](https://liarjs.dev) - [what the checks mean](https://liarjs.dev/cli/) - [field notes](https://liarjs.dev/blog/)\n\n\n```bash\nnpx skills add liarjs.dev                  # from the site's well-known endpoint\nnpx skills add liarjsdev/liarjs-skills     # from this repo\n```\n\n## The skills\n\n| skill | use it when |\n|---|---|\n| [`browser-fingerprint-audit`](skills/browser-fingerprint-audit/) | run a browser fingerprint test and read the result: canvas, WebGL, WebGL2, WebGPU, audio, 220 fonts, WebRTC, timezone, TLS |\n| [`playwright-stealth-verify`](skills/playwright-stealth-verify/) | check whether a Playwright, Puppeteer, Selenium or CDP-driven browser presents a coherent fingerprint, as an assertion in a test |\n| [`fingerprint-ci-gate`](skills/fingerprint-ci-gate/) | fail a GitHub Actions or GitLab job on a fingerprint regression, with a baseline diff |\n| [`fingerprint-failure-triage`](skills/fingerprint-failure-triage/) | turn a low score into a shortlist of things to change, by check id |\n\nEach skill is a directory with a `SKILL.md` following the [Agent Skills](https://agentskills.io)\nformat, so it works in any client that supports the standard: Claude Code, Codex, Cursor,\nGitHub Copilot, VS Code, Gemini CLI, OpenCode, Amp, Windsurf, Goose, Kiro and others.\n\n## Install\n\nWith the cross-agent installer:\n\n```bash\nnpx skills add liarjs.dev                                               # all four, from the site\nnpx skills add liarjsdev/liarjs-skills                                  # all four, from this repo\nnpx skills add liarjsdev/liarjs-skills/skills/browser-fingerprint-audit # just one\n```\n\n`liarjs.dev` works because the site publishes this same tree at\n`/.well-known/agent-skills/index.json` (RFC 8615), so no directory site sits between you and the\nskills. The generator lives in the site repo as `scripts/sync-skills.mjs` and takes this repo as its\nsource of truth.\n\nOr copy a skill directory into the location your agent reads:\n\n| agent | path |\n|---|---|\n| Claude Code | `~/.claude/skills/` (user) or `.claude/skills/` (project) |\n| Codex | `~/.agents/skills/` |\n| GitHub Copilot | `~/.copilot/skills/` (user) or `.github/skills/` (repo) |\n\n## What the underlying tool does\n\nA browser controls its own JavaScript. It does not control the network it connects over. `liarjs`\nreads the fingerprint inside the browser, reads the TLS/HTTP/ASN view from the edge that served the\nrequest, and reports every place the two stories disagree.\n\n```\n   18 / 100  Likely spoofed / bot\n\n  x navigator.webdriver -40\n    webdriver=true, the automation flag is set.\n    id: webdriver\n\n  x Worker <-> main-thread consistency -20\n    A Web Worker reported different values than the main thread for userAgent, canvasHash.\n    id: worker-consistency\n\n  22 checks - 2 critical - 1 warnings - 18 clean\n  edge: 203.0.113.7 - AS4058 - LAS - HTTP/2 - TLSv1.3\n```\n\n32 of the 40 checks need nothing but the browser (`--offline`). 8 compare the JavaScript story\nagainst the wire. Full list with deductions:\n[`checks.md`](skills/browser-fingerprint-audit/references/checks.md).\n\nRequirements: Node 22 or newer, and a local Chrome, Chromium or Edge. `liarjs` has zero runtime\ndependencies.\n\n## Scope and safety\n\nThese skills are measurement and diagnostics. They ship no evasions, profiles or proxies.\n\n- A scan launches its own Chrome with a fresh profile in a temp directory and deletes it when the\n  run ends. It does not read the user's browser profile, history, cookies or saved credentials.\n- No token, login or account is involved. The skills never ask an agent to handle secrets.\n- Nothing is fetched at runtime that changes agent behaviour: the instructions and reference files\n  are the whole content, and the npm package is version-pinned in every command.\n- Probes run on `about:blank` by default. The skills do not direct an agent to browse third-party\n  sites, and they state that scan output is data to relay rather than instructions to follow.\n- Attaching to an already-running browser (`--cdp`) is documented as an explicit, user-requested\n  path, not a default, because that drives a session the user owns.\n- The one outbound request in the default path is the browser under test fetching\n  `https://liarjs.dev/api/net.json`, which answers with what Cloudflare saw about that request.\n  `--offline` makes no request at all; `--endpoint <url>` points at your own deployment of that\n  Worker. liarjs.dev does not store scans.\n\n## Related packages\n\n| package | what it is |\n|---|---|\n| [`liarjs`](https://www.npmjs.com/package/liarjs) | the CLI and library API these skills drive |\n| [`@liarjs/collect`](https://www.npmjs.com/package/@liarjs/collect) | the 19 browser-side probes, standalone |\n| [`@liarjs/checks`](https://www.npmjs.com/package/@liarjs/checks) | the 40 consistency rules as pure functions |\n\nSource for all three: [github.com/liarjsdev/liarjs](https://github.com/liarjsdev/liarjs).\n\n## Limits worth stating up front\n\n- A score is not a ban prediction. It measures internal coherence. Real sites also weigh IP\n  reputation, account age and behaviour, none of which a local scan can see.\n- Headless is detected on purpose. A stock headless run loses points, and that is the correct\n  measurement.\n- Checks drift with Chrome. The rules are versioned with the package and reviewed per Chrome major,\n  which is why every command here pins a version.\n\nMIT (c) liarjs.dev\n",
  "bytes": 5703,
  "sha": "1010be0cc1cb2a02f68da81a84ae08fa73427151920969627e75d004104c0900",
  "repo_slug": "liarjsdev/liarjs-skills",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/skl_liarjsdev_liarjs_skills_playwright_steal_aad73187/readme"
}