/pinchtab-stealth-score

name: pinchtab-stealth-score
description: "Run the PinchTab stealth-score sweep against 15 bot-detection / fingerprint sites (sannysoft, rebrowser, deviceandbrowserinfo, iphey, whoer, browserscan, pixelscan, fingerprint-scan, incolumitas, fvision, amiunique, browserleaks, creepjs, coveryourtracks, fingerprint-demo). Starts a Docker PinchTab container per browser (chrome / cloak / both), spawns a blind agent that drives PinchTab through plain-English per-site playbooks, captures structured metrics, prints a side-by-side comparison highlighting divergent metrics, and appends to history.jsonl for cross-session tracking. Use when asked to 'run stealth score', 'compare cloak vs chrome detection', 'measure stealth', or '/pinchtab-stealth-score'."

PinchTab Stealth Score

Drive PinchTab through a list of public bot-detection sites under each browser (`chrome`, `cloak`, or `both`), and collect the metrics that matter most for analyst comparison. `up.sh` reuses cached images, so pass `REBUILD=1` when you need to benchmark the current working tree.

The shape is the same as `/pinchtab-opt`: one container per run, one blind agent that reads English playbooks and drives PinchTab through `./scripts/pt`, records per-site metrics, and the orchestrator summarizes.

Argument Parsing

• `/pinchtab-stealth-score` → default to `both`
• `/pinchtab-stealth-score chrome` → chrome only
• `/pinchtab-stealth-score cloak` → cloak only
• `/pinchtab-stealth-score both` → run both sequentially

Anything else → print this section and abort.

Site Catalogue

The agent processes the sites listed in `tests/stealth-score/sites/index.md` (currently 15). The list is dynamic — to add or remove sites you only edit that index and the matching `<id>.md` playbook. The skill itself doesn't hard- code site names.

Current sites (15) — `sannysoft`, `rebrowser`, `deviceandbrowserinfo`, `iphey`, `whoer`, `browserscan`, `pixelscan`, `fingerprint-scan`, `incolumitas`, `fvision`, `amiunique`, `browserleaks` (multi-page: canvas+webgl+fonts+tls), `creepjs`, `coveryourtracks`, `fingerprint-demo`.

Expected duration: ~12-15 min per browser once images are cached, so a `both` run takes ~25-30 min plus first-time image build (~10 min for cloak).

Path Resolution

PROJECT_ROOT=$(git rev-parse --show-toplevel)
SCORE_DIR="$PROJECT_ROOT/tests/stealth-score"
RESULTS_DIR="$SCORE_DIR/results"
TIMESTAMP=$(date -u +%Y%m%dT%H%M%SZ)
mkdir -p "$RESULTS_DIR"

Prerequisites

Docker must be running.

docker info >/dev/null 2>&1 || { echo "Docker not running"; exit 1; }

If port 9867 on the host is already taken (e.g. a native PinchTab server), free it first — both the chrome and cloak containers bind 9867:

pinchtab daemon stop 2>&1 || true
sleep 2
pkill -9 -f "pinchtab " 2>/dev/null || true

Execution

For each requested browser, run the same loop:

1. Bring up the container

"$SCORE_DIR/up.sh" "$PROVIDER"

`up.sh` builds the appropriate image if absent (`pinchtab-local:test` + `pinchtab-chrome-smoke:test`, or `pinchtab-cloakbrowser:test`), writes a browser config with open `allowedDomains`, and starts a container named `stealth-score-pinchtab` on host port 9867. It exits non-zero if the container fails to become healthy.

To force a rebuild: `REBUILD=1 "$SCORE_DIR/up.sh" "$PROVIDER"`.

2. Seed the report JSON

REPORT_FILE="$RESULTS_DIR/${PROVIDER}_${TIMESTAMP}.json"
cat > "$REPORT_FILE" <<JSON
{
  "provider": "${PROVIDER}",
  "timestamp": "${TIMESTAMP}",
  "started_at": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
  "completed_at": null,
  "sites_processed": 0,
  "sites": []
}
JSON

3. Spawn the agent

Use the **Agent** tool. Prompt template — replace `{PROVIDER}`, `{REPORT_FILE}`, `{PROJECT_ROOT}`:

You are running a PinchTab stealth-score sweep against a Docker container.

PROVIDER: {PROVIDER}
REPORT_FILE: {REPORT_FILE}
PROJECT_ROOT: {PROJECT_ROOT}

Read these files first (do NOT read anything under tests/stealth-score/results/):
1. {PROJECT_ROOT}/tests/stealth-score/subagent-context.md — environment, wrapper, recording format.
2. {PROJECT_ROOT}/tests/stealth-score/sites/index.md — list of sites to process and in what order.
3. {PROJECT_ROOT}/skills/pinchtab/SKILL.md — PinchTab command reference.

The site list currently has ~15 entries. Work through them in the order index.md gives. For each site:
- Read its playbook (sites/<id>.md). It describes what to navigate to, what to wait for, any clicks needed, and which metrics to capture.
- Drive PinchTab through the {PROJECT_ROOT}/tests/tools/scripts/pt wrapper. Before any pt call: cd {PROJECT_ROOT}/tests/tools and export PINCHTAB_CONTAINER=stealth-score-pinchtab and PINCHTAB_TOKEN=stealth-score-token.
- Extract the listed metrics from what you actually observe on the page. Capture as many of the listed metrics as you can find — partial captures are fine; record "unavailable" plus a brief reason when a metric isn't present.
- Append a JSON record to REPORT_FILE per the recording format in subagent-context.md.

Time-box each site to ~2 minutes. If a site is slow, hangs, or shows a Cloudflare challenge, record what you have, set notes accordingly, and move on.

Finalize the report (set completed_at + sites_processed) and print STEALTH_SCORE_RUN_COMPLETE on stdout as your final line.

The container is already running and healthy. Do NOT touch Docker, do NOT switch browsers, do NOT run `pinchtab server` or `daemon` — the wrapper talks to the container directly.

4. Tear down

"$SCORE_DIR/down.sh"

When both browsers are requested, run **sequentially**: up → agent → down for chrome, then up → agent → down for cloak. They share port 9867.

Summarize

After all per-browser JSON reports exist, build the side-by-side comparison using the Go runner:

"$PROJECT_ROOT/tests/tools/scripts/runner" stealth compare \
  "$RESULTS_DIR"/*_${TIMESTAMP}.json

`tests/tools/scripts/runner` is a tracked self-