/sap-browser-automation

name: sap-browser-automation
description: Use when an agent must inspect or operate an authenticated SAP web UI through an in-app Browser, Microsoft Edge CDP, or an existing Playwright client, especially when SAP SSO reuse, isolated Edge profiles, deterministic target selection, screenshots, or browser bootstrap recovery is required.
license: GPL-3.0
metadata:
  maintainer: "Eduard Jiglau"
  maintainer_email: "hello@sap-ai-skills.com"
  website: "https://sap-ai-skills.com"
  version: "2.4.1"
  last_verified: 2026-07-14
  documentation_source: "docs/project/sap-browser-automation-source-review-2026-07-14.md"
  status: docs_audited_runtime_pending
  known_issues:
    - In-app Browser authentication is desktop-runtime-dependent and its validation is deferred to Codex or Claude Desktop.
    - SAC and Datasphere SSO, cross-domain cookies, client certificates, MFA, and enterprise Edge policy require tenant-specific verification.

SAP Browser Automation

Use this skill as the shared browser layer for SAP-specific skills. It owns surface selection, authentication bootstrap, isolated Edge/CDP startup, state reuse, target verification, evidence, recovery, and cleanup. The consuming skill still owns the SAP action boundaries: story edits, planning writeback, model changes, Datasphere deployment, SQL execution, and test acceptance.

Related Skills

• **sap-sac-scripting**: SAC story/runtime scripting and reporting-story implementation.
• **sap-sac-test-automation**: SAC acceptance, discovery packets, Playwright suites, and evidence.
• **sap-sac-planning**: SAC planning models, writeback, versions, data actions, and locks.
• **sap-datasphere**: Datasphere modeling, deployment, spaces, connections, and administration.
• **browser:control-in-app-browser**: Installed in-app Browser runtime and secure manual authentication.

When to Use This Skill

Use this skill whenever an agent must interact with an authenticated SAP web UI, select or inspect a browser target, start Edge with loopback CDP, reuse an approved Edge profile, transfer scoped browser state to an already-installed compatible client, or recover from browser bootstrap/authentication failure. Do not use it for code-only, API-only, CLI-only, or database-native tasks that do not need visible browser state.

Quick Reference

| Need | Route | | --- | --- | | Manual SSO in the current browser | In-app Browser, then visible signed-in verification | | Enterprise Edge or no Playwright installation | Fresh isolated Edge with copied profile and loopback CDP | | Independent compatible browser context | Existing Playwright plus scoped `storageState` or CDP state transfer | | Missing auth or failed browser bootstrap | User-assisted login, recovery, or specification-only handoff |

Operating contract

• Prefer a connector, API, CLI, or database-native check when it can answer the request without a browser.
• Try the in-app Browser first when it is available and the task needs authenticated visible UI.
• Ask the user to authenticate manually in the in-app Browser when its target redirects to SSO. Use its secure authentication capability; never ask for passwords or OTPs in chat.
• After in-app verification, use the fresh Edge path for reliable automation when the task needs CDP, enterprise extensions, or a reusable profile.
• Ask explicit permission before reusing the user's authenticated normal Edge profile or closing Edge.
• Copy only after Edge is closed, and copy to an isolated profile path. Treat the copy, cookies, tokens, local storage, and storage-state files as credentials.
• Bind CDP to `127.0.0.1`; never expose the port, WebSocket endpoint, profile, or auth state to a network, repository, log, screenshot, or Oracle review.
• Verify the tenant, host, path, title, authenticated DOM, and target page before interaction. Never guess the first tab or target ID.
• Default to read-only actions. The consuming SAP skill must explicitly authorize writes, publishing, deployment, planning, model, permission, or destructive actions.
• Browser startup, CDP attachment, or a successful login redirect is not evidence that the requested SAP task completed.

Load the focused references only when needed:

• `references/edge-cdp-control.md` for Edge launch, CDP discovery, target selection, and recovery.
• `references/auth-state-bootstrap.md` for copying an authenticated Edge profile, exporting scoped state when available, and injecting it into compatible clients.
• `references/in-app-browser-auth.md` for manual in-app authentication and capability boundaries.
• Run `scripts/edge-profile.ps1` for deterministic profile cloning, launch, status, and stop operations.
• Run `scripts/cdp-agent.mjs` for target discovery, inspection, interaction, screenshots, and authentication-state transfer. It requires Node.js 22 or newer and no npm packages.

Standard workflow

1. Classify the task and choose a surface

Record the target application, tenant/host, requested URL, read/write intent, evidence required, and whether the user approved profile reuse. Use this order:

1. Existing non-browser tool if sufficient. 2. In-app Browser for visible authenticated UI and manual SSO. 3. Fresh isolated Edge with loopback CDP for enterprise browser behavior and reusable authentication. 4. Already-installed Playwright connected over CDP or using local storage state. 5. Approved desktop/manual assistance or a specification-only handoff.

Do not install Playwright, browser binaries, MCP servers, or extensions in an enterprise environment unless the user explicitly requests and approves that change. If Playwright is unavailable, Edge/CDP remains the primary automation surface.

2. Authenticate in the in-app Browser

Open the target using the installed Browser skill. Inspect visible state. If the page requires SSO, pause for the user to complete the login manually through the supported secure auth flow. Verify a positive signed-in signal on the target domain and retain a