T06 · System Persistence
Error
- Location
references/setup-guide.md:7- Finding
Tor Is Registered as a Persistent Startup Service
- Content
View full analysis
- Remediation
View remediation
Security audit
Tor Browser Automation
Security checks for vulnerabilities and agentic risk
Overview
The skill’s Tor browser purpose is coherent, but its setup guidance can create persistent services and expose Tor proxy/control ports in ways users should review carefully.
Install only if you need Tor-specific browser automation. Review and run any sudo, service, Docker, or firewall commands manually; avoid exposing port 9051, bind any proxy to localhost, keep Tor control authentication enabled, prefer pinned dependencies/images, and avoid entering sensitive credentials into untrusted pages.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T08 · Insecure Dependencies
Warning
- Location
references/setup-guide.md:22- Finding
Unpinned Playwright Components and Mutable Third-Party Container Image
- Content
View full analysis
- Remediation
View remediation
" ``` - Use a lock file with cryptographic hashes, such as a hash-checked `requirements.txt`. - Pin the expected browser revision through the reviewed Playwright release and document artifact verification. - Pin the container image by immutable digest: ```bash docker run ... repository/image@sha256: ``` - Prefer an official or independently reviewed Tor image and document its provenance. - Add a dependency-update process that reviews release notes, verifies hashes, and reruns security testing before updating pins. - Avoid running package installation as root unless it is strictly required; use a virtual environment or isolated build stage. ]]>
T09 · Insecure Skill Coding Practices
Error
- Location
references/setup-guide.md:22- Finding
Tor SOCKS and Control Ports Are Published While Cookie Authentication Is Disabled
- Content
View full analysis
- Remediation
View remediation
@sha256: ``` - Prefer an internal Docker network when both Tor and the browser run in containers, avoiding host publication entirely. - Keep `CookieAuthentication 1` for local control-port access. - If password authentication is genuinely required, generate a strong hashed password with Tor's supported tooling and store the underlying secret securely. - Restrict the control listener to loopback and enforce host firewall rules. - Add a startup validation that rejects wildcard-bound proxy or control listeners unless the user explicitly acknowledges the exposure. - Remove the unused `tor_control_port` configuration field unless authenticated circuit-control functionality is implemented. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/tor-browser.py:63- Finding
Content Security Policy Is Globally Bypassed for Untrusted Pages
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (23)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
The chained command
sudo apt install tor && sudo systemctl start torcombines package installation and service startup in a single privileged line, reducing opportunities for review or failure handling between steps. In agent-facing documentation, such chaining can make accidental or overly broad system modification more likely.- Content
Quick setup:
bash # Install Tor sudo apt install tor && sudo systemctl start tor # Install Python dependencies pip install playwright
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The description is broad enough to trigger this skill for general browsing tasks, including non-Tor use cases, because it mentions navigation, screenshots, and data extraction in generic terms. That increases the chance an agent invokes a dark-web-capable browsing tool in situations where a standard browser skill would be safer and more appropriate.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill describes browsing, screenshots, and extraction capabilities without clearly warning that visited URLs, form submissions, and interaction metadata will be transmitted through the Tor network and that screenshots/output files may persist locally. In a privacy-sensitive context, missing disclosure can cause unintentional data handling, evidence creation, or policy violations.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 84% confidence
- Finding
The documented setup command instructs users to run
sudo apt install tor && sudo systemctl start tor, which requires elevated privileges and chains privileged actions. Even though it is standard system administration guidance, embedding root-level commands in a skill increases the risk of agents or users executing privileged operations without sufficient review.- Content
Quick setup:
bash # Install Tor sudo apt install tor && sudo systemctl start tor # Install Python dependencies pip install playwright
Context Window Stuffing
Medium
- Category
- Memory Poisoning
- Confidence
- 85% confidence
- Finding
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
- Content
md # Click element by ref tor-browser click @e1 # Fill input field tor-browser fill @e2 "text to enter" # Wait for page load
Context Window Stuffing
Medium
- Category
- Memory Poisoning
- Confidence
- 85% confidence
- Finding
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
- Content
python # Click element by ref tor-browser click @e1 # Fill input field tor-browser fill @e2 "text to enter" # Wait for page load
Context Window Stuffing
Medium
- Category
- Memory Poisoning
- Confidence
- 85% confidence
- Finding
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
- Content
python # Click element by ref tor-browser click @e1 # Fill input field tor-browser fill @e2 "text to enter" # Wait for page load
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 76% confidence
- Finding
The troubleshooting step uses
sudo systemctl status tor, which again normalizes privileged execution inside the skill documentation. While lower risk than install/start commands, it still encourages elevated command use that may be inappropriate in restricted or automated environments.- Content
bash # Check Tor is running sudo systemctl status tor # Test SOCKS5 proxy curl --socks5-hostname 127.0.0.1:9050 https://check.torproject.org/api/ip
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 78% confidence
- Finding
The instruction
sudo journalctl -u tor -frequires elevated privileges and may expose sensitive operational logs. In an agent skill, recommending privileged log access can broaden the blast radius if the skill is used in environments with access to confidential system data.- Content
curl --socks5-hostname 127.0.0.1:9050 https://check.torproject.org/api/ip
View Tor logs
sudo journalctl -u tor -f
text ### Common Errors
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Ubuntu/Debian:
bash sudo apt update sudo apt install tor sudo systemctl enable tor sudo systemctl start tor
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Ubuntu/Debian:
bash sudo apt update sudo apt install tor sudo systemctl enable tor sudo systemctl start tor
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Ubuntu/Debian:
bash sudo apt update sudo apt install tor sudo systemctl enable tor sudo systemctl start tor
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Ubuntu/Debian:
bash sudo apt update sudo apt install tor sudo systemctl enable tor sudo systemctl start tor
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Ubuntu/Debian:
bash sudo apt update sudo apt install tor sudo systemctl enable tor sudo systemctl start tor
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file instructs users to run privileged commands such as installing packages, enabling and starting the Tor service, and later adjusting firewall rules. While the guide is instructional, it does not explicitly warn users that these actions alter system configuration and may affect network exposure or require administrative privileges.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash sudo apt update sudo apt install tor sudo systemctl enable tor sudo systemctl start tor
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md ## Troubleshooting ### Connection refused - Ensure Tor service is running: `sudo systemctl status tor` - Check firewall: `sudo ufw allow 9050` ### Timeout errors
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md ## Troubleshooting ### Connection refused - Ensure Tor service is running: `sudo systemctl status tor` - Check firewall: `sudo ufw allow 9050` ### Timeout errors
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The
navigatemethod issues live browser requests to arbitrary URLs, including .onion destinations, which is a network operation that may transmit user-supplied targets and browser metadata. The code contains no user-facing warning, confirmation, or disclosure at execution time beyond terse technical docstrings.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The screenshot method can write page captures to an arbitrary file path when
pathis provided, which is a file write affecting local user data. Although the method has a technical docstring, there is no confirmation prompt or explicit user-facing warning that page content will be persisted to disk.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The
check_tor_connectionroutine navigates tohttps://check.torproject.org/api/ip, causing an external network request that reveals connectivity details to a third-party service. There is no explicit user-facing warning that invoking this command contacts an outside endpoint and retrieves IP-related information.- Content
Static analysis
No suspicious patterns detected.