Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Phantom Browser
v0.1.1Undetectable browser automation for AI agents. 31/31 stealth tests passed. WindMouse physics, per-profile fingerprinting, residential IP routing. Runs headle...
⭐ 0· 74·0 current·0 all-time
by@aces1up
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
SKILL.md and the description promise a sophisticated stealth browser (WindMouse physics, fingerprinting, residential routing, system-level access control). The shipped files (phantom_browser.py + setup.sh) contain only an early-access registration/status tool and dependency bootstrap — no code implements the claimed browser automation or proxy/fingerprinting features. That is a substantive mismatch between what is advertised and what is delivered.
Instruction Scope
Runtime instructions direct users to run setup.sh, create a venv, install dependencies, save a config to ~/.phantom-browser/config.json and a local .env, and POST the user's email and chosen use_case to https://clawagents.dev/reddit-rank/v1/phantom-browser/interest. Those actions are coherent for an early-access registration flow, but SKILL.md's broad claims about stealth behavior are not realized in the instructions — instructions do transmit minimal personal data (email + use_case) to an external service.
Install Mechanism
No platform install spec is declared; setup.sh creates a Python venv and pip-installs small dependencies (requests, python-dotenv) from PyPI. This is a typical, moderate-risk install mechanism (no arbitrary binary downloads or obscure hosts).
Credentials
The skill does not request environment variables, special credentials, or access to unrelated config paths. It writes/reads a local config at ~/.phantom-browser/config.json and creates a .env with an install id — these are proportionate to a waitlist/registration flow. The only external data transmitted is the email and selected use_case collected interactively.
Persistence & Privilege
always is false and the skill does not request system‑wide privileges. It does create a per-user directory (~/.phantom-browser) and a venv in the skill directory; that is expected. The SKILL.md claim of 'system-level access control' is not implemented in the provided code, which is an inconsistency worth noting.
What to consider before installing
What to consider before installing:
- The files included do NOT implement the advertised stealth browser; they only implement an early-access registration and status tool. The marketing claims (undetectable automation, fingerprinting, residential routing, system-level locks) are not present in the code you were given — treat the published description as promotional rather than functional.
- setup.sh will create a Python virtual environment, pip-install requests and python-dotenv, write a config to ~/.phantom-browser/config.json and a local .env, and POST your email and selected use_case to https://clawagents.dev/reddit-rank/v1/phantom-browser/interest. If you do not want to send that information, do not run setup.sh and instead inspect or run the scripts in a sandbox.
- The network POST of your email/use_case is expected for a waitlist flow, but verify the remote domain and consider privacy implications before sending personally identifying data.
- If you expect a working stealth browser, ask the publisher for the full source, provenance, and a changelog showing where the claimed browser engine lives. Do not grant this skill network/system-wide privileges implicitly; run it in an isolated environment (VM/container) until the real functionality and provenance are validated.
- Be aware of legal/ethical risks: tools designed to evade platform detection can enable abusive or policy-violating activity. Ensure your intended use complies with laws and platform terms before deploying any stealth automation.Like a lobster shell, security has layers — review code before you run it.
latestvk97ewxzakz6d04p6n9fcnfa14n83hhvy
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
