Stealth v2.1

A 14-layer Chrome init script that masks puppeteer / playwright / CDP fingerprints. Required for Etsy, Cults3D, Reddit, Discord and LinkedIn. The non-negotiable wrapper around every stealth automation.

The 14 layers

1. navigator.webdriver deletion.
2. chrome.runtime + chrome.app reconstruction.
3. Plugins + mimeTypes synthesis (matches stable Chrome).
4. Permissions API patch (notifications query no longer always denied).
5. WebGL vendor / renderer mask (Intel HD Graphics 5500).
6. Canvas noise (subtle, deterministic per session).
7. AudioContext fingerprint noise.
8. Fonts API allowlist (limits enumeration).
9. HardwareConcurrency + deviceMemory normalisation.
10. Battery API recall (no Battery on modern Chrome).
11. RTC IP leak block (TURN-only).
12. iframe srcdoc isolation.
13. Notification.permission patch.
14. __pacer — human-timing wait helper (call before every click/type/scroll).

The one rule

Usage with puppeteer-core

import { readFileSync } from 'fs';
import puppeteer from 'puppeteer-core';

const STEALTH = readFileSync('/opt/skills/stealth/stealth-init.min.js', 'utf8');

const browser = await puppeteer.connect({ browserURL: 'http://127.0.0.1:9222' });
const page = await browser.newPage();
await page.evaluateOnNewDocument(STEALTH);
await page.goto('https://www.etsy.com/...');
await window.__pacer.wait(800, 1500); // every interaction

Usage with chrome-devtools-mcp

// In the agent prompt:
"navigate to https://www.etsy.com using initScript=STEALTH,
 then call __pacer.wait(800, 1500) before every click"

Verification

Run node /opt/skills/stealth/verify.mjs inside the workspace. It opens bot.sannysoft.com, browserleaks.com and creepjs and prints a PASS/FAIL table.

Known limits

• Stealth v2.1 is reliable on Tier 4 platforms (Reddit, X, Etsy, Cults3D).
• Tier 5 ML platforms (Instagram, Facebook live actions) still need Kameleo (Pro / Ultra) — stealth alone isn't enough.
• Discord trust scoring escalates quickly. Never use a real personal account.