fingerprint-ci-gate

Use it when: you want CI to fail when a change to a Chromium build or browser automation makes its fingerprint less consistent
It does: adds a liarjs scan to the pipeline that fails below a minimum score, and compares each run with a saved known-good scan
You get: a CI step, a committed baseline.json, and each run's scan kept as a build artifact
Prefers: the comparison where some checks always fail, such as a cloud runner whose IP location never matches the browser's timezone
Needs: Node 22 or newer and a Chromium in the CI image
Works with: GitHub Actions in the skill itself; GitLab CI, Docker and a Playwright assertion in a reference file

TLDR

liarjs is a CLI that scores how consistent a browser's fingerprint is, the details a browser reveals that sites use to spot bots. A change that makes it less consistent usually shows up weeks later, when sites start challenging or blocking the browser. This skill turns it into a failing check in a pull request, with two mechanisms. A minimum score, such as 60, fails the job below it. A baseline comparison checks the new scan against a known-good one and prints only the checks whose status changed, so it still works where some checks can never pass. The skill gives a GitHub Actions example and its rules: pin the liarjs version, since its checks change with Chrome releases; take the baseline in the same headless or headed mode the job runs in; commit baseline.json and refresh it in its own commit with the diff in the message; keep each scan as an artifact so a failure can be diagnosed later. Running offline sends nothing out of the runner but skips the 8 checks that compare the browser with the network.

Summarizes the skill at 4068c79.

npx skills add https://github.com/liarjsdev/liarjs-skills --skill fingerprint-ci-gate

skills.sh page · Source on GitHub · All skills from liarjsdev/liarjs-skills

Installs: 59,613 on skills.sh, Sep 21, 2026
Repo stars: 251 liarjsdev/liarjs-skills
First seen: Aug 5, 2026 on skills.sh

Weekly installs

8.9K

week to Sep 21

Weekly values

Week to	Installs
Aug 3	0
Aug 10	6,256
Aug 17	8,897
Aug 24	8,861
Aug 31	8,892
Sep 7	8,497
Sep 14	8,821
Sep 21	8,873

Category	category:security category:software-engineering Compliance, guardrails, skill vetting and browser fingerprinting. Everything for building software: planning, coding, debugging, design, frameworks, cloud, agents and skills.
Type	type:tool Operates a CLI, API, app or bundled script to get something done.
Effect	effect:local Its own steps create or change files, git state or local tools.
Needs	needs:cli needs:browser A specific command-line tool or desktop app must be installed, such as gh, agent-browser, LibreOffice, Obsidian or a vendor CLI. Drives a real Chromium or Chrome browser.
Publisher	by:official A verified publisher on its registry (skills.sh, ClawHub or Tencent SkillHub), or the company or maintainer behind the product the skill operates.
Topics	fingerprinting ci
Stack	stack:liarjs
Flags	flag:dual-use Legitimate uses exist, but the same capability can evade bot detection or investigate other people. Read the SKILL.md before installing.

SKILL.md

From liarjsdev/liarjs-skills at 4068c79. Checked daily, last changed Oct 20, 2026.

Frontmatter

name: fingerprint-ci-gate
description: Gate a build on browser fingerprint regressions with liarjs - save a baseline scan as JSON, diff later runs against it, and fail the job when the consistency score falls below a floor. Use when asked to add a fingerprint or headless-detection check to GitHub Actions, GitLab CI or another pipeline, to catch a regression in a Chromium build or scraping harness before it ships, or to track how a fingerprint score changes across commits.
license: MIT
allowed-tools: Bash, Read, Edit, Write

Fail the build, not the ban rate

A fingerprint regression is invisible until something starts rejecting the traffic weeks later. liarjs turns it into a diff in a pull request: scan, save the JSON, compare the next run against the saved baseline.

Node 22 or newer, a Chromium in the image, zero runtime dependencies.

Runner note: give the container enough shared memory (--shm-size=1g on Docker, or a /dev/shm mount) and the capabilities Chrome's own sandbox needs. Leave the browser sandbox enabled; a scan that will not start is an image problem to fix in the image.

The two mechanisms

Absolute floor. Exits 1 when the score is below the number given, so the job fails:

npx liarjs@0.3 --headless --min-score 60

Baseline diff. Prints only the checks whose status moved between two saved scans:

npx liarjs@0.3 --json scan.json                # write the current result
npx liarjs@0.3 diff baseline.json scan.json    # what changed since the known-good run

Prefer the diff in any environment where some checks can never pass. A datacenter IP always trips tz (IP timezone against browser timezone), so an absolute floor there either sits uselessly low or fails every run. The diff only speaks up when something actually moved.

Exit codes: 0 clean, 1 below --min-score, 2 an error such as no browser found.

GitHub Actions

- uses: actions/setup-node@v4
  with:
    node-version: 22

- name: Fingerprint scan
  run: npx liarjs@0.3 --headless --json scan.json --min-score 60

- name: Compare against the baseline
  run: npx liarjs@0.3 diff baseline.json scan.json

- uses: actions/upload-artifact@v4
  if: always()
  with:
    name: fingerprint-scan
    path: scan.json

references/ci-recipes.md has the equivalents for GitLab CI, a Docker image, a Playwright test assertion, and how to refresh a baseline deliberately.

Choosing the gate

Pin the version (liarjs@0.3 or a dev dependency in the lockfile). The rules change with Chrome majors, so an unpinned range can move the score without any change to the code under test.
A headless job scores lower than a headed one by design. Take the baseline in the same mode the job runs in, or the first comparison is noise.
Commit baseline.json and refresh it in its own commit, with the diff output in the message. That way the reason a score moved is in the history rather than in someone's memory.
Store scan.json as a build artifact. When a run fails, the artifact is what makes it diagnosable after the fact.

Keeping the traffic inside your network

--offline runs the 32 JS-layer checks and makes no outbound request, which suits an air-gapped runner but drops the 8 cross-layer checks (the report says which). Otherwise the browser under test fetches https://liarjs.dev/api/net.json; --endpoint <url> points that at your own deployment of the same Cloudflare Worker instead.

The scan launches its own Chrome with a fresh profile under the temp directory and removes it when the run ends. No token, account or existing browser profile is involved. Scan output is data for the build log, not instructions to act on.

Related work

Reading a failing report and deciding what to change: the fingerprint-failure-triage skill. Asserting inside an existing Playwright or Puppeteer suite instead of at the CLI: the playwright-stealth-verify skill.