ClawHub
Back to skill

Security audit

Agent Browser with Camoufox

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but its installer makes broad system-level tooling changes using unverified remote installers and mutable dependencies.

Review before installing. This skill is not clearly malicious, but it can permanently alter your development environment by installing global packages and replacing agent-browser. Prefer running it only in a disposable VM/container or after rewriting the installer to pin versions, avoid curl-to-shell, use a project-local install, show diffs, require confirmation, and provide a tested rollback path.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/install.sh:66
Finding

Unverified Remote Installer Scripts Are Executed Directly by the Shell

Content
View full analysis

Vulnerability Details

File Location: scripts/install.sh:66, scripts/install.sh:282; also recommended in SKILL.md:55, SKILL.md:161, README.md:21, and README.md:120
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

scripts/install.sh:66:

bash
curl -LsSf https://astral.sh/uv/install.sh | sh

scripts/install.sh:282:

bash
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y

The same unsafe installation pattern is presented to users in the documentation:

bash
# SKILL.md:55 and README.md:21
curl -LsSf https://astral.sh/uv/install.sh | sh

# SKILL.md:161 and README.md:120
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh

Technical Analysis

The installation workflow downloads mutable content from external URLs and immediately passes it to a shell. The content is not pinned to a version, saved for inspection, authenticated with a publisher signature, or checked against a known cryptographic digest.

HTTPS provides transport protection but does not establish that the retrieved script is the exact version reviewed with this Skill. An upstream compromise, malicious release, compromised hosting environment, or unexpected future modification could therefore change the effective code executed by the installer.

Installing uv and Rust may support the declared build process, but direct remote-to-shell execution is not necessary and does not follow least-risk installation practices. The Rust command additionally accepts unattended installation with -y, reducing the opportunity for user review.

Attack Path

  1. An attacker compromises an upstream installer, its hosting infrastructure, or the associated release process.
  2. The content returned from astral.sh/uv/install.sh or sh.rustup.rs is replaced with attacker-controlled shell commands.
  3. A user runs scripts/install.sh ...[truncated 962 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not pipe downloaded content directly into a shell.
  2. Pin each installer or release artifact to a specific immutable version.
  3. Download the artifact to a newly created private temporary directory.
  4. Verify a publisher signature or a hardcoded SHA-256 digest obtained through an independent trusted channel.
  5. Display or otherwise make the verified script available for inspection before execution.
  6. Prefer trusted operating-system package managers where supported.
  7. Avoid unattended flags unless they are essential and clearly disclosed.
  8. Update README.md and SKILL.md so the manual instructions use the same verified procedure.
  9. Explicitly warn users not to run the installer as root or through sudo.

T08 · Insecure Dependencies

Error
Location
scripts/install.sh:86
Finding

Mutable and Unpinned Third-Party Dependencies Are Installed and Built

Content
View full analysis

Vulnerability Details

File Location: scripts/install.sh:86-97, scripts/install.sh:160, scripts/install.sh:181-190, and scripts/install.sh:270-273; corresponding manual commands appear in SKILL.md:61, SKILL.md:79, SKILL.md:92, SKILL.md:111, README.md:24, README.md:34, and README.md:59
Vulnerability Type: Insecure third-party dependency installation
Risk Level: High

Vulnerable Code

bash
if uv pip show camoufox >/dev/null 2>&1 || python3 -c "import camoufox" 2>/dev/null; then
    log_success "camoufox Python 包已安装"
else
    log_info "使用 uv 安装 camoufox..."
    uv pip install camoufox --system || pip3 install camoufox

    if python3 -c "import camoufox" 2>/dev/null; then
        log_success "camoufox Python 包安装成功"
    else
        log_warn "uv 安装失败，尝试 pip3..."
        pip3 install camoufox
    fi
fi
bash
npm install -g agent-browser
bash
TEMP_DIR=$(mktemp -d)
log_info "临时克隆 agent-browser 源码到: $TEMP_DIR"

git clone --depth 1 https://github.com/browser-use/agent-browser.git "$TEMP_DIR/agent-browser" 2>/dev/null || {
    log_warn "无法克隆仓库，尝试直接修改已编译的 JS..."
}

if [ -d "$TEMP_DIR/agent-browser/src" ]; then
    BROWSER_TS_PATH="$TEMP_DIR/agent-browser/src/browser.ts"
    cd "$TEMP_DIR/agent-browser"
fi
bash
if [ -f "package.json" ]; then
    log_info "在源码目录中，安装依赖并编译..."
    npm install

Technical Analysis

The installer resolves packages and repository content by mutable names or branch state rather than immutable versions:

  • camoufox is installed without an exact version or hash.
  • agent-browser is globally installed without an exact version.
  • The Git repository is cloned at its current default-branch head rather than a reviewed commit.
  • npm install resolves dependency content and may execute dependency lifecycle scripts.
  • Python installation uses --system or a direct pip3 fallback rather tha ...[truncated 1669 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin Python and npm packages to exact reviewed versions.
  2. Use hash-locked Python requirements, such as a requirements file containing approved hashes.
  3. Commit and enforce an npm lockfile with immutable dependency versions.
  4. Clone a specific reviewed Git commit and verify its signed tag or commit signature.
  5. Run npm with lifecycle scripts disabled when they are not required; separately audit any lifecycle scripts that must execute.
  6. Install Camoufox in a dedicated virtual environment instead of using --system.
  7. Install the modified npm package in a project-local directory or under a dedicated application prefix instead of the default global package tree.
  8. Verify package provenance and integrity before importing, building, or executing downloaded components.
  9. Fail closed when verification is unavailable rather than falling back to another unverified installer.

T07 · Tool Hijacking and Spoofing

Error
Location
scripts/install.sh:299
Finding

Installer Patches and Replaces a Globally Installed Browser Automation Tool

Content
View full analysis

Vulnerability Details

File Location: scripts/install.sh:193-260, scripts/install.sh:299-310, and scripts/install.sh:325-367; global replacement is also documented in SKILL.md:115-125
Vulnerability Type: Tool hijacking through global package modification
Risk Level: High

Vulnerable Code

The source-patching fallback performs broad textual replacement:

python
# 查找并替换简单的返回语句
if 'return "chromium"' in content or "return 'chromium'" in content:
    content = content.replace(
        'return "chromium"',
        '''const lowerPath = executablePath.toLowerCase();
    if (lowerPath.includes('firefox') || lowerPath.includes('camoufox')) {
      return 'firefox';
    }
    return 'chromium'"'''
    )
    with open("$BROWSER_TS_PATH", "w") as f:
        f.write(content)
    print("简单替换完成")

The rebuilt source tree then replaces the global package:

bash
if [ -d "$AGENT_BROWSER_PATH" ]; then
    # 备份
    BACKUP_PATH="${AGENT_BROWSER_PATH}.backup.final.$(date +%Y%m%d_%H%M%S)"
    mv "$AGENT_BROWSER_PATH" "$BACKUP_PATH"
    log_info "原版本备份到: $BACKUP_PATH"

    # 复制新版本
    cp -r . "$AGENT_BROWSER_PATH"
    log_success "新版本已替换到: $AGENT_BROWSER_PATH"
fi

The compiled-JavaScript fallback can replace the first generic Chromium return it finds:

python
patterns = [
    r'(getBrowserType\([^)]*\)\s*\{[^}]*return\s+["\']chromium["\'])',
    r'(return\s+["\']chromium["\'])',
]

modified = False
for pattern in patterns:
    if re.search(pattern, content):
        new_code = '''const lowerPath = executablePath.toLowerCase();
        if (lowerPath.includes('firefox') || lowerPath.includes('camoufox')) {
            return 'firefox';
        }
        return 'chromium' '''

        content = re.sub(
            r"return\s+['\"]chromium['\"]",
            new_code,
            content
        )
        modified = True
        break

...[truncated 2369 chars]

Remediation
View remediation

Remediation Suggestions

  1. Maintain a pinned, reviewed fork of agent-browser and install it under a distinct command name.
  2. Prefer a project-local installation or dedicated application prefix over modification of the global npm package.
  3. Apply a conventional patch file to an exact source version and abort if any expected context differs.
  4. Verify the source archive or commit before patching.
  5. Replace regex-based source rewriting with an AST-aware transformation or an upstream-supported configuration mechanism.
  6. Confirm the resulting diff contains only the intended browser-type change.
  7. Run targeted tests before installation and verify the built artifact's digest.
  8. Copy only required runtime artifacts rather than the complete build directory.
  9. Require explicit user confirmation before replacing any existing installation and provide a tested rollback command.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/install.sh:199
Finding

Predictable Shared Temporary File Permits Symlink-Based File Overwrite

Content
View full analysis

Vulnerability Details

File Location: scripts/install.sh:199-208
Vulnerability Type: Unsafe temporary-file handling
Risk Level: Medium

Vulnerable Code

bash
cat > /tmp/browser_type_patch.txt << 'PATCH_EOF'
  private getBrowserType(executablePath: string): 'chromium' | 'firefox' {
    const lowerPath = executablePath.toLowerCase();
    if (lowerPath.includes('firefox') || lowerPath.includes('camoufox')) {
      return 'firefox';
    }
    return 'chromium';
  }
PATCH_EOF

Technical Analysis

The script writes to a fixed, predictable path in the shared /tmp directory. It does not create the file atomically, verify ownership, reject symbolic links, or place the file inside the private directory already created with mktemp -d.

On systems where another local user can create entries in /tmp, an attacker can pre-create /tmp/browser_type_patch.txt as a symbolic link. Shell redirection follows the link and truncates the linked target before cat writes the here-document.

The generated patch file is not used elsewhere in the reviewed script, so this filesystem write is unnecessary for the Skill's declared function.

Attack Path

  1. A local attacker predicts that the installer will write /tmp/browser_type_patch.txt.
  2. Before the victim runs the installer, the attacker creates that path as a symbolic link to a file writable by the victim.
  3. The victim runs scripts/install.sh.
  4. The > redirection follows the symbolic link and truncates the target.
  5. The target is overwritten with the TypeScript method body.
  6. Depending on the selected target, the victim may suffer configuration corruption, denial of service, or altered behavior in another user-level tool.

Impact Assessment

Exploitation allows overwrite or corruption of files that the invoking user can write. It does not independently bypass filesystem permissions, so an unprivileged run normally limits impa ...[truncated 145 chars]

Remediation
View remediation

Remediation Suggestions

Remove this write because the generated file is unused.

If a temporary patch file becomes necessary:

  1. Place it inside the private directory returned by mktemp -d.
  2. Set a restrictive umask, such as umask 077.
  3. Quote all paths.
  4. Register a cleanup trap that only removes the validated temporary directory.
  5. Do not use fixed names in shared temporary directories.
  6. Avoid running the installer with elevated privileges.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (27)

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The '| sh' pattern is a direct command-chaining anti-pattern because it converts network-delivered content into immediate code execution. This is especially risky in a skill that patches globally installed tooling and alters browser automation behavior, since compromise could tamper with both the environment and the installed automation stack.

Content

Scanner excerpt · README.md (reported line 21)May include surrounding context.

bash
# 安装 uv
curl -LsSf https://astral.sh/uv/install.sh | sh

# 安装 camoufox
uv pip install camoufox --system

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

Using '| sh' with the Rust bootstrap script creates an immediate arbitrary-code-execution path controlled by a remote response. Because the subsequent environment sourcing can affect future shells, exploitation may have lasting effects beyond the initial command.

Content

Scanner excerpt · README.md (reported line 120)May include surrounding context.

bash
# 安装 Rust
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
source ~/.cargo/env

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The declared description presents the skill as a browser deployment helper, but the body performs broader and riskier actions including fetching external code, installing toolchains, compiling software, and replacing a system-wide package. This mismatch can mislead users or automation into approving a skill that has far greater system impact than advertised.

Content

No source excerpt is available for this finding.

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The use of a command chain that streams network content directly into sh is a classic high-risk execution pattern. It removes opportunities for inspection and creates a single-step path from untrusted remote content to code execution, which is especially dangerous in an automation-oriented skill.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

1. 安装 uv

bash
curl -LsSf https://astral.sh/uv/install.sh | sh

2. 安装 camoufox

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

This troubleshooting command repeats the same chaining-abuse pattern by piping a remote rustup script into sh. In context, the skill already performs broad system modification, so adding another direct remote execution path materially increases the attack surface and makes compromise more dangerous.

Content

Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.

解决: 安装 Rust

bash
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
source ~/.cargo/env

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

A remote installer is executed via curl | sh without any explicit warning, review opportunity, or user confirmation. This creates a direct arbitrary-code-execution path and is especially risky in an automation skill where users may run the installer as-is.

Content

No source excerpt is available for this finding.

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The use of a shell pipe into sh is a classic command-chaining pattern that turns a network fetch directly into code execution with no validation boundary. In a one-click install skill, this is especially dangerous because users are encouraged to execute the script non-interactively and may not inspect the remote payload.

Content

Scanner excerpt · scripts/install.sh (reported line 66)May include surrounding context.

sh
log_success "uv 已安装: $(uv --version)"
else
    log_info "正在安装 uv..."
    curl -LsSf https://astral.sh/uv/install.sh | sh
    
    # 添加 uv 到 PATH
    if [ -f "$HOME/.local/bin/env" ]; then

Missing User Warnings

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script programmatically rewrites installed TypeScript/JavaScript source and compiled artifacts in place, which is a powerful and risky operation even if intended for compatibility. In the context of a browser automation skill advertising anti-detection behavior, silent in-place patching makes it harder for users to audit what code will actually run and could be abused to insert persistent malicious behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

A second remote installer is fetched and executed for Rust setup using curl | sh -y, again with no warning or consent. This compounds the arbitrary-code-execution risk and increases system modification scope beyond the stated browser patching task.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script moves aside the existing global package directory and replaces it with a rebuilt local copy, a destructive overwrite of trusted installed tooling. If the build or patch step is compromised, this creates persistence by swapping the user's normal package for attacker-influenced code across future invocations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README instructs users to execute a remote script directly via curl-pipe-to-shell, which gives the remote server immediate code execution on the user's machine with no opportunity to inspect the script first. In a skill focused on deploying an anti-detection browser toolchain, this is more dangerous because users are encouraged to make system-level changes and may normalize running unreviewed installer code.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · README.md (reported line 101)May include surrounding context.

bash
# 确认路径
ls -la ~/Library/Caches/camoufox/Camoufox.app/Contents/MacOS/camoufox

# 手动下载
python3 -c "from camoufox.sync_api import Camoufox; Camoufox()"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README instructs piping the Rust installer from a remote URL straight into sh, which can execute arbitrary code if the upstream source, DNS, TLS termination, or delivery path is compromised. Because this modifies the local development environment and shell profile, compromise can persist beyond the initial install.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill instructs shell execution, file modification, and overwriting globally installed packages, but it does not declare any explicit tool scope or permissions boundary. This increases the chance that an agent or user executes high-impact actions without clear consent or sandboxing, especially because the workflow includes package installation and system-wide replacement steps.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The one-click installation flow includes remote installer execution and system modifications without prominent warnings, confirmation steps, or rollback guidance. Users may run commands that alter their environment globally without understanding the trust and integrity implications of piping remote scripts into a shell.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instructions direct users to overwrite a globally installed agent-browser package after recompilation, which can silently replace a trusted system component with a locally modified version. Without strong warnings and integrity checks, this creates supply-chain and persistence risks and can break other workflows that depend on the original package.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The installer fetches and executes a remote shell installer for uv, introducing execution of third-party code beyond the local patching logic in this script. Because the code is piped directly to sh with no pinning, integrity verification, or review step, compromise of the upstream host or network path would lead to arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The script installs and then alters a globally installed npm package under the system/user global npm path, affecting tooling outside the local project scope. Without an explicit warning and consent step, this can unexpectedly break existing workflows or replace trusted binaries with modified code.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script clones upstream source from GitHub and may rebuild it locally, which materially expands the trust boundary from patching an installed package to executing build steps on freshly fetched code. If the repository or dependency chain is compromised, npm install/build and cargo build can execute attacker-controlled install scripts or build logic.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill documentation presents its instructions in Chinese only, including setup and usage guidance, with no indication that the language is optional or that the skill is intended solely for a Chinese-speaking context. This can violate a language/locale policy when users are not given a choice or opt-in.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The README fetches and executes an external installer script from the network, creating a supply-chain risk if that source is compromised or replaced. In this skill's context, users are being guided to install tooling for browser automation and anti-detection behavior, increasing the chance they will run powerful setup commands without scrutiny.

Content

Scanner excerpt · README.md (reported line 21)May include surrounding context.

bash
# 安装 uv
curl -LsSf https://astral.sh/uv/install.sh | sh

# 安装 camoufox
uv pip install camoufox --system

External Script Fetching

Low
Category
Supply Chain
Confidence
94% confidence
Finding

Fetching the Rust installer from a remote endpoint and immediately handing it to the shell exposes users to upstream compromise and opaque system modifications. Even when the source is legitimate, the documentation removes review and verification safeguards that would reduce risk.

Content

Scanner excerpt · README.md (reported line 120)May include surrounding context.

bash
# 安装 Rust
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
source ~/.cargo/env

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

Most of the instructional content is presented only in Chinese, which effectively forces a specific language for users consuming the skill documentation. There is no opt-in, alternative language, or stated reason that the skill must be Chinese-only.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The skill fetches and executes a remote installation script directly from the network using curl piped to sh. This is dangerous because compromise of the remote source, transport, or upstream release process would immediately translate into arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

1. 安装 uv

bash
curl -LsSf https://astral.sh/uv/install.sh | sh

2. 安装 camoufox

External Script Fetching

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The Rust installation troubleshooting step also retrieves and executes a remote script directly via curl | sh, creating the same arbitrary code execution risk from an external source. Because it is presented as a fix path, users may execute it quickly under troubleshooting pressure without adequate review.

Content

Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.

解决: 安装 Rust

bash
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
source ~/.cargo/env

Static analysis

No suspicious patterns detected.