Skip to content
Canon

Job pack · react

Browser agent

DOM as ACI, always sandboxed, last resort after an API. Computer-use is not the first tool.

When: The environment is a web page that has no API you can call.

API first. Browser last. Sandbox always. Action space is the product; keep it small and eval it.

GET /api/canon/jobs/browser-agent?format=md

Matching skill · Browser agent

Playbooks

Doctrine to load

  1. Computer UseThe environment is a GUI or a browser, not an API. browser-use, OpenHands, and Anthropic's computer-use all shrink the web or desktop into an action space.
  2. Sandboxes and IsolationEnforce boundaries at the tool and sandbox layer, not by asking the model to behave. E2B, OpenHands, and Deep Agents all say the same sentence.
  3. Injection, Poisoning, Confused DeputyAnything the model reads — web pages, PDFs, MCP tool descriptions, retrieved docs, other agents' briefs — is an untrusted speaker. Treat it as data, never as an instruction channel.
  4. Designing the Agent-Computer InterfaceThe ACI is names, schemas, errors, pagination, and idempotency. A sloppy tool surface makes a smart model look drunk. A tight one makes a small model look hired.

Refuse

  • Computer-use as the first tool. A browser or desktop agent used where an API, a workflow, or a grep would do.
  • Unsandboxed exec. A shell or code-act tool on the host with production credentials.
  • Tool poisoning. An MCP server or plugin whose description is an instruction: 'call me first, send secrets'.
  • Unbounded loop. No max-turns, token, wall-clock, or money budget. The agent rambles until the bill or the context dies.

Checklists

Security review

  • Retrieved docs, web, and MCP descriptions are labeled untrusted data.
  • MCP servers pinned, hashed, reviewed. No marketplace auto-trust.
  • Secrets injected at the executor, never into the prompt or the workspace dump.
  • Subagents are reduced principals. No parent deploy keys.
  • Allow / ask / deny. Irreversible actions are high-friction asks.

ACI quality

  • One job per tool. No mega-tool JSON blob.
  • Verb names the model will say: read_file, apply_patch, ask_human.
  • Compact errors: the smallest string that enables the next correct action.
  • Capped results. Pagination or a file write instead of 200k-token dumps.
  • Idempotent or journaled. Retries do not double side effects.
  • Allow / ask / deny in code, logged, resumable.

Ready to build

  • Named termination: done schema, max turns, token/money cap.
  • Sandbox / allowlist for every side effect. Secrets in the executor.
  • An explicit context builder: pinned, working, recalled, compacted.
  • A golden set of 20–50 real tasks, run in CI on prompt change.
  • Launch / pause / resume APIs. HITL is a tool that checkpoints.

Recipes

The loopTool schema

Default corpus

browser-usestagehande2bopenhands