/sap-browser-automation

name: sap-browser-automation
description: Use when an agent must inspect or operate an authenticated SAP web UI through an in-app Browser, Microsoft Edge CDP, or an existing Playwright client, especially when SAP SSO reuse, isolated Edge profiles, deterministic target selection, screenshots, or browser bootstrap recovery is required.
license: GPL-3.0
metadata:
  maintainer: "Eduard Jiglau"
  maintainer_email: "hello@sap-ai-skills.com"
  website: "https://sap-ai-skills.com"
  version: "2.4.1"
  last_verified: 2026-07-14
  documentation_source: "docs/project/sap-browser-automation-source-review-2026-07-14.md"
  status: docs_audited_runtime_pending
  known_issues:
    - In-app Browser authentication is desktop-runtime-dependent and its validation is deferred to Codex or Claude Desktop.
    - SAC and Datasphere SSO, cross-domain cookies, client certificates, MFA, and enterprise Edge policy require tenant-specific verification.

SAP Browser Automation

Use this skill as the shared browser layer for SAP-specific skills. It owns surface selection, authentication bootstrap, isolated Edge/CDP startup, state reuse, target verification, evidence, recovery, and cleanup. The consuming skill still owns the SAP action boundaries: story edits, planning writeback, model changes, Datasphere deployment, SQL execution, and test acceptance.

Related Skills

• **sap-sac-scripting**: SAC story/runtime scripting and reporting-story implementation.
• **sap-sac-test-automation**: SAC acceptance, discovery packets, Playwright suites, and evidence.
• **sap-sac-planning**: SAC planning models, writeback, versions, data actions, and locks.
• **sap-datasphere**: Datasphere modeling, deployment, spaces, connections, and administration.
• **browser:control-in-app-browser**: Installed in-app Browser runtime and secure manual authentication.

When to Use This Skill

Use this skill whenever an agent must interact with an authenticated SAP web UI, select or inspect a browser target, start Edge with loopback CDP, reuse an approved Edge profile, transfer scoped browser state to an already-installed compatible client, or recover from browser bootstrap/authentication failure. Do not use it for code-only, API-only, CLI-only, or database-native tasks that do not need visible browser state.

Quick Reference

| Need | Route | | --- | --- | | Manual SSO in the current browser | In-app Browser, then visible signed-in verification | | Enterprise Edge or no Playwright installation | Fresh isolated Edge with copied profile and loopback CDP | | Independent compatible browser context | Existing Playwright plus scoped `storageState` or CDP state transfer | | Missing auth or failed browser bootstrap | User-assisted login, recovery, or specification-only handoff |

Requested browser and connection are binding

If the user names Chrome, Edge, Chrome DevTools MCP, CDP, or a local DevTools bridge, use only that browser and connection method. Do not silently switch to the In-app Browser, a ChatGPT browser extension, Playwright, Computer Use, another browser, or shell automation. If the requested surface is not available, report the exact blocker and stop at that boundary.

Operating contract

• Prefer a connector, API, CLI, or database-native check when it can answer the request without a browser.
• Use the in-app Browser first only when the user has not named a different browser or connection method.
• Ask the user to authenticate manually in the in-app Browser when its target redirects to SSO. Use its secure authentication capability; never ask for passwords or OTPs in chat.
• After in-app verification, use the fresh Edge path for reliable automation when the task needs CDP, enterprise extensions, or a reusable profile.
• Treat MCP configuration and MCP availability as separate checks. After configuration, verify that the server tools are present in the active tool registry. A successful `codex mcp get` check alone does not make the MCP usable.
• Require a live handshake, such as `list_pages`, and verify that the returned pages belong to the requested browser. If the tools are missing after configuration, ask the user to restart Codex or open a new task before continuing.
• Ask explicit permission before reusing the user's authenticated normal Edge profile or closing Edge.
• Copy only after Edge is closed, and copy to an isolated profile path. Treat the copy, cookies, tokens, local storage, and storage-state files as credentials.
• Bind CDP to `127.0.0.1`; never expose the port, WebSocket endpoint, profile, or auth state to a network, repository, log, screenshot, or Oracle review.
• Verify the tenant, host, path, title, authenticated DOM, and target page before interaction. Never guess the first tab or target ID.
• Default to read-only actions. The consuming SAP skill must explicitly authorize writes, publishing, deployment, planning, model, permission, or destructive actions.
• Browser startup, CDP attachment, or a successful login redirect is not evidence that the requested SAP task completed.

Load the focused references only when needed:

• `references/edge-cdp-control.md` for Edge launch, CDP discovery, target selection, and recovery.
• `references/auth-state-bootstrap.md` for copying an authenticated Edge profile, exporting scoped state when available, and injecting it into compatible clients.
• `references/in-app-browser-auth.md` for manual in-app authentication and capability boundaries.
• Run `scripts/edge-profile.ps1` for deterministic profile cloning, launch, status, and stop operations.
• Run `scripts/cdp-agent.mjs` for target discovery, inspection, interaction, screenshots, and authentication-state transfer. It requires Node.js 22 or newer and no npm packages.

Standard workflow

1. Classify the task and choose a surface

Record the target application, tenant/host, requested URL, read/write intent, evidence required, and whether the user approved profile reuse. Use this order:

1. Existing non-brows