Skill: marmutapp/superbased (version 2.0.2)

--- name: superbased description: Eyes AND hands for OpenClaw — capture, AI vision, OCR, recording, voice dictation, and full GUI automation via 72 MCP tools. Use when the agent needs to see the user's screen OR drive their desktop (click / type / scroll / drag / form-fill / sequence) AND when the user mentions screenshots, screen recording, visual regression, OCR, voice transcription, or asks to automate a UI workflow. --- SuperBased gives OpenClaw agents both eyes (screen capture, AI vision, OCR) and hands (full GUI automation with humanization v2 + CAPTCHA-solving guidance) on the user's desktop. The actual capabilities are exposed through 72 MCP tools served by the SuperBased MCP server (`superbased mcp`); this skill bundle teaches the agent **when** to reach for which tool. ## Two-step install (run once) ```bash # 1. Install this skills bundle from ClawHub openclaw skills install superbased # 2. Register the SuperBased MCP server openclaw mcp set superbased '{"command":"superbased","args":["mcp"]}' # 3. (Pre-req) the SuperBased CLI on PATH npm install -g superbased ``` Optional: install the SuperBased desktop app from [superbased.app](https://superbased.app) for a GUI to browse captures, configure providers, and manage the gallery. When the desktop app is running, `superbased mcp` auto-bridges to it via a PID file at `~/.superbased/`, so OpenClaw and the desktop share state. ## When to use SuperBased Trigger SuperBased when the user's request involves any of: - **Seeing what's on screen** — "look at this", "what's on my screen", "describe what I'm seeing", "read this dialog" - **Verifying a UI change** — "did the button update?", "is the error gone?" - **Reading content that's hidden behind scroll** — "what are all the settings?", "walk me through the sidebar" - **Visual regression testing** — "record a baseline of the login flow", "did anything change visually?" - **Watching for issues during long-running processes** — "monitor my deploy for errors", "let me know if anything fails" - **Extracting text from images / screen** — "OCR this", "extract the text from this region" - **Voice input** — "transcribe what I'm about to say", "type via dictation" - **Compressing large text into images** — "send this 5K-token block as one image" - **Annotating / redacting screenshots** — "highlight the broken thing", "redact the API key before sharing" - **Driving the desktop UI** — "click that button", "type into the email field", "fill out this form", "press Cmd+S" - **Multi-step workflow automation** — "open File menu, pick Open, type the path, press Enter, screenshot the result" - **Solving in-flow CAPTCHA challenges** — "this drag puzzle is blocking me", "select all squares with traffic lights" - **Fighting bot detection** — when an automation flow on a hardened site needs cursor-trajectory humanization ## Sub-skills (use these as the agent's working knowledge) The 11 SKILL.md files in this bundle each cover one trigger category. Read the relevant one first when the user request matches its description: | File | Use when | |---|---| | [skills/screenshot/SKILL.md](./skills/screenshot/SKILL.md) | Capturing the screen at the right resolution / window / region | | [skills/visual-qa/SKILL.md](./skills/visual-qa/SKILL.md) | Record-baseline → make-changes → record-again → diff workflow | | [skills/monitor/SKILL.md](./skills/monitor/SKILL.md) | Proactive screen watching during deploys, tests, builds | | [skills/walkthrough/SKILL.md](./skills/walkthrough/SKILL.md) | Reading a scrollable section end-to-end via `superbased_scroll_capture` | | [skills/compress/SKILL.md](./skills/compress/SKILL.md) | Converting large text to token-efficient images | | [skills/redact/SKILL.md](./skills/redact/SKILL.md) | Auto-redacting secrets / PII before sharing | | [skills/dictation/SKILL.md](./skills/dictation/SKILL.md) | Voice input, audio transcription, speech-to-text | | [skills/annotate/SKILL.md](./skills/annotate/SKILL.md) | Highlighting areas, marking regressions, drawing on captures | | [skills/gui-automation/SKILL.md](./skills/gui-automation/SKILL.md) | Click / type / scroll / drag / form-fill / sequence — driving the desktop | | [skills/captcha-solving/SKILL.md](./skills/captcha-solving/SKILL.md) | reCAPTCHA / Cloudflare Turnstile / drag puzzles / rotation puzzles / image grids | | [skills/humanization/SKILL.md](./skills/humanization/SKILL.md) | Picking the right `humanize` profile (off / light / human / paranoid) per call | ## The 72 MCP tools at a glance Capture & View (5): `superbased_screenshot`, `_capture_image`, `_capture`, `_gallery_image`, `_window_list` AI & OCR (8): `superbased_ai`, `_ai_usage`, `_ocr`, `_transcribe`, `_compress_text`, `_project`, `_workspace_sync`, `_stt_status` Gallery (2): `superbased_gallery`, `_gallery_update` Privacy & Annotations (2): `superbased_redact`, `_annotate` Dictation & Voice (2): `superbased_dictate`, `_dictation_history` Recording & Visual QA (7): `superbased_recording`, `_sessions`, `_describe_frames`, `_narrate`, `_diff`, `_baseline`, `_export` Settings, Auth & System (6): `superbased_settings`, `_presets`, `_auth`, `_license`, `_health`, `_clipboard` GUI Automation (40): `superbased_ui_dump`, `_scroll_capture`, `_scroll_to`, `_sequence`, `_click`, `_type`, `_hotkey`, `_scroll`, `_drag`, `_drag_file`, `_hover`, `_context_menu_select`, `_form_fill`, `_dialog_handle`, `_open_url`, `_find_in_page`, `_tab_management`, `_tray_click`, `_virtual_desktop`, `_window_state`, `_resize_window`, `_focus_window`, `_window_bounds`, `_find_title_bar_drag_region`, `_display_list`, `_launch_app`, `_find_image`, `_capture_template`, `_pixel_color`, `_ax_invoke`, `_accessibility_tree`, `_locate`, `_wait`, `_wait_for`, `_mouse_position`, `_dry_run`, `_replay`, `_doctor_gui_automation`, `_undo_last`, `_tools` ## Safety rails (for the GUI automation surface) Before any state-modifying GUI action (click, type, drag, sequence, form_fill, etc.): 1. The master toggle (Settings > GUI Automation > Enabled) must be on. Run [REDACTED_SECRET] to verify. 2. Per-action toggles (click, type, hotkey, scroll, drag, hover) must each be enabled. 3. Every state-modifying call must pass `confirm: true` — the server refuses without it. 4. Protected-apps blocklist + NDJSON audit log are server-side; users can audit every action you took. ## When to bump humanization Default `humanize: 'light'` is enough for most consumer sites. Bump to `'human'` for sites with active bot detection (Cloudflare-fronted, reCAPTCHA-gated). Bump to `'paranoid'` for hardened targets (banking, ticketing, social media bot crackdowns). See `skills/humanization/SKILL.md` for the full picker. ## Links - [SuperBased](https://superbased.app) — Desktop app + npm CLI - [npm: superbased](https://www.npmjs.com/package/superbased) — The CLI providing the MCP server - [Source-of-truth Claude Code plugin](https://github.com/marmutapp/superbased-claude-code-plugin) — Where shared content (skills) is mastered - [OpenClaw](https://openclaw.ai) + [ClawHub](https://clawhub.ai) — The runtime + registry

path: README.md
content: # SuperBased — Eyes AND Hands for OpenClaw

Screenshot capture, AI vision, OCR, screen recording, voice dictation, **and full GUI automation with humanization v2** — all via 72 MCP tools, directly inside [OpenClaw](https://openclaw.ai).

This is a [ClawHub](https://clawhub.ai) skill bundle that ships proactive guidance for SuperBased's MCP toolkit. The actual 72 tools come from the SuperBased MCP server — the skill bundle tells the OpenClaw agent **when** to use them and **how**.

## Install (two steps)

### 1. Install the skill bundle from ClawHub

```bash
openclaw skills install superbased
```

This downloads the 11 SKILL.md files into your OpenClaw workspace's `skills/` directory.

### 2. Register the SuperBased MCP server

```bash
openclaw mcp set superbased '{"command":"superbased","args":["mcp"]}'
```

This points OpenClaw at the SuperBased CLI for the actual tool calls.

### 3. (One-time) install the SuperBased CLI

```bash
npm install -g superbased
```

This is the binary that the MCP server invocation runs.

### 4. (Optional) install the SuperBased desktop app

The desktop app for Windows/macOS gives you a GUI for browsing captures, configuring providers, and managing the gallery. When the desktop app is running, `superbased mcp` auto-detects it via the PID file at `~/.superbased/` and acts as a stdio↔HTTP bridge — so OpenClaw and the desktop share the same gallery / sessions / settings.

Download from [superbased.app](https://superbased.app).

## Skills (11)

| Skill | When OpenClaw Uses It |
|-------|-----------------------|
| **screenshot** | OpenClaw needs to see what's on the user's screen |
| **visual-qa** | Visual regression testing: record baseline → make changes → record again → diff |
| **monitor** | Proactive screen watching during deploys, tests, builds |
| **compress** | Large text content (>500 tokens) that would be cheaper as an image |
| **redact** | Screenshots that may contain API keys, tokens, or PII before sharing |
| **dictation** | Voice input, audio transcription, or speech-to-text |
| **annotate** | Highlighting areas, marking regressions, creating annotated screenshots |
| **walkthrough** | Multi-frame product walkthrough: capture, narrate, export |
| **gui-automation** | "Click that", "type into this", "fill the form" — drives the desktop with click/type/hotkey/scroll/drag/form-fill/sequence |
| **captcha-solving** | reCAPTCHA / Cloudflare Turnstile / drag puzzles / rotation puzzles / image grids |
| **humanization** | Sites with bot detection — picks the right humanization profile (off/light/human/paranoid) |

## Humanization v2

GUI automation actions (`click`, `type`, `drag`, `hover`) ship with a humanization layer to reduce the bot-detection signal: sin-shaped velocity envelope on cursor walks, gaussian click-target jitter, gamma-distributed pre-click settle dwell, 50–110 ms click hold variation, 45–95 ms key hold, wired typo simulation with QWERTY same-row neighbors, pre-click tremor on the target element, occasional 2–4× micro-pauses, per-process cross-session salt mixed into seeds, inter-action catch-up pause, and opt-in idle cursor drift.

Four profiles selectable per call: `humanize: 'off' | 'light' | 'human' | 'paranoid'`. Default `light`. Bump to `human` or `paranoid` for sites with active bot detection — see the **humanization** skill.

## CAPTCHA solving

Plugin ships proactive guidance for the four CAPTCHA classes: image grids (vision identifies, batched click sequence), drag puzzles (one-motion drag with `humanize: 'light'`), rotation puzzles (calibrate-then-execute), and checkbox-only Turnstile. Plus the honest "what humanization can't defeat" list (server-side fingerprinting, audio CAPTCHAs, hCaptcha enterprise mode). See the **captcha-solving** skill.

## MCP Tools (72)

The 72 tools come from the SuperBased MCP server. Categories: Capture & View (5), AI & OCR (8), Gallery (2), Privacy & Annotations (2), Dictation & Voice (2), Recording & Visual QA (7), Settings/Auth/System (6), and **GUI Automation (40)**.

See [the source-of-truth Claude Code plugin README](https://github.com/marmutapp/superbased-claude-code-plugin#mcp-tools-72) for the full categorized list with collapsibles.

## Why two install steps?

ClawHub registers **skills** (when/how to use a tool) and **plugins** (TypeScript code), but does NOT register MCP servers directly. The clean split:

- **Skills bundle (this package)** — published to ClawHub, installable via `openclaw skills install superbased`. Tells the agent when to reach for SuperBased and what's possible.
- **MCP server (`superbased mcp`)** — registered separately via `openclaw mcp set superbased '...'`. Provides the actual 72 tools.

There is no built-in OpenClaw plugin from us. ClawHub doesn't list MCP servers via the plugin wrapper, so a wrapper plugin would just add ceremony without unlocking discoverability. If we ship one later, it'll be for OpenClaw-specific lifecycle hooks (e.g. auto-capture on chat-app message events).

## Verifying the install

```bash
openclaw mcp list                         # superbased should be listed
openclaw mcp show superbased              # see the registered config
openclaw skills list                      # superbased skills should appear
openclaw skills check                     # validates the local skill environment
superbased --version                      # confirms CLI is on PATH
```

## Links

- [SuperBased](https://superbased.app) — Desktop app + npm CLI
- [npm: superbased](https://www.npmjs.com/package/superbased) — The CLI providing the MCP server
- [Source-of-truth Claude Code plugin](https://github.com/marmutapp/superbased-claude-code-plugin) — Where shared content (skills) is mastered
- [OpenClaw](https://openclaw.ai) + [ClawHub](https://clawhub.ai) — The runtime + registry


path: mcp-config-snippet.json
content: {
  "command": "superbased",
  "args": ["mcp"]
}


path: skill-bundle.json
content: {
  "slug": "superbased",
  "name": "SuperBased",
  "version": "2.0.2",
  "description": "Screen capture, AI vision, OCR, recording, dictation, and full GUI automation (72 MCP tools) with humanization v2 + CAPTCHA-solving guidance — gives OpenClaw agents eyes on the screen and hands on the desktop.",
  "homepage": "https://superbased.app",
  "repository": "https://github.com/marmutapp/superbased-openclaw-plugin",
  "license": "MIT",
  "author": {
    "name": "Gaja AI",
    "email": "[REDACTED_SECRET]"
  },
  "tags": [
    "screenshot",
    "screen-capture",
    "ocr",
    "ai-vision",
    "screen-recording",
    "visual-testing",
    "token-compression",
    "dictation",
    "monitor",
    "gui-automation",
    "click-automation",
    "form-fill",
    "captcha",
    "humanization",
    "mcp"
  ],
  "skills": [
    "screenshot",
    "visual-qa",
    "monitor",
    "compress",
    "redact",
    "dictation",
    "annotate",
    "walkthrough",
    "gui-automation",
    "captcha-solving",
    "humanization"
  ],
  "requirements": {
    "mcpServer": {
      "name": "superbased",
      "transport": "stdio",
      "command": "superbased",
      "args": [
        "mcp"
      ],
      "installHint": "npm install -g superbased"
    },
    "platforms": [
      "windows",
      "macos",
      "linux"
    ],
    "node": ">=20"
  }
}


Security scan verdicts — ClawScan: malicious | static analysis: clean | VirusTotal: suspicious | SkillSpector:  ()