Security audit

camofox-default-browser

Security checks for vulnerabilities and agentic risk

Overview

This is a powerful anti-detection browser skill with disclosed legitimate uses, but its install, startup, network exposure, and cookie-handling guidance create review-worthy security risk.

Install only in a tightly isolated environment. Pin and verify the Camoufox binary, avoid curl-to-bash setup, bind the API to localhost, require a strong bearer token for every browser-control endpoint, disable permissive CORS, do not use seccomp=unconfined, and treat imported cookies as live account credentials with 600 permissions and no diagnostic printing.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

Location: INSTALL.md:168
Finding: Remote Node.js setup script is executed as root without verification
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: INSTALL.md:70
Finding: Unpinned native browser binary is downloaded and executed without integrity verification
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/startup.sh:6
Finding: Startup script executes server code from a predictable writable temporary directory
Content: View full analysis
/dev/null || cd /tmp/camofox-browser # Check if server already running if curl -sf http://localhost:9377/health >/dev/null 2>&1; then exit 0 fi export CAMOUFOX_EXECUTABLE nohup node server.js --port 9377 > /tmp/camofox-daemon.log 2>&1 & disown ``` ### Technical Analysis If the expected extension directory does not exist or cannot be entered, the script falls back to the predictable path `/tmp/camofox-browser` and executes `server.js` from the resulting current directory. It does not verify: - Whether the fallback `cd` succeeded. - Ownership or permissions of the fallback directory. - Ownership or integrity of `server.js`. - Whether the directory is writable by untrusted local users. - Whether symbolic links redirect files to attacker-controlled locations. On typical systems, `/tmp` is globally writable. Although the sticky bit prevents users from deleting files owned by others, it does not prevent an attacker from creating a previously nonexistent predictable directory and populating it with a malicious `server.js`. ### Attack Path 1. A local attacker creates `/tmp/camofox-browser`. 2. The attacker writes a malicious `server.js` into that directory. 3. The expected `/root/.openclaw/extensions/camofox-browser` path is absent, renamed, temporarily unavailable, or inaccessible. 4. The startup script falls back to `/tmp/camofox-browser`. 5. `node server.js --port 9377` executes the attacker-controlled script. 6. The malicious script inherits the startup account's privileges and environment. ### Impact Assessment The attacker obtains arbitrary JavaScript execution under the account invoking the startup script. If startup is performed as roo ...[truncated 213 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: INSTALL.md:195
Finding: Browser management API is documented with optional authentication and unsafe network exposure
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: TROUBLESHOOTING.md:157
Finding: Troubleshooting instructions make session-cookie credentials world-readable and print their values
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: AGENTS.md:211
Finding: Agent guidance recommends disabling the container seccomp sandbox
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (80)

Privileged Container / Container Escape

High

Category: Privilege Escalation
Confidence: 97% confidence
Finding: Recommending --security-opt seccomp=unconfined weakens container isolation by disabling syscall filtering, expanding the blast radius of a browser compromise or malicious content execution. Given this skill drives an anti-detection browser against arbitrary external sites, reducing sandbox protections materially increases host risk.
Content: Scanner excerpt · AGENTS.md (reported line 213)May include surrounding context.
text
### "EPERM: Sandbox" error Container needs seccomp profile adjustment. Add `--security-opt seccomp=unconfined` to Docker run args, or Camoufox will auto-fallback to non-sandboxed mode. ### "Tab no longer exists (browser was restarted)" Browser was idle too long and shut down. Create a new tab.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · CONFIGURATION.md (reported line 24)May include surrounding context.
Example .env Snippet

bash
# File: ~/.openclaw/.env (or wherever OpenClaw reads its env vars) CAMOUFOX_EXECUTABLE=/root/.cache/camoufox/camoufox CAMOFOX_API_KEY=cf-api-xxxx-xxxx-xxxx-xxxxxxxxxx CAMOFOX_CRASH_REPORT_ENABLED=false

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · FAQ.md (reported line 152)May include surrounding context.
bash
npm update -g @jo-inc/camofox # if installed globally via npm # or reinstall from source: rm -rf /root/.cache/camoufox/* npm install -g @jo-inc/camofox openclaw gateway restart

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · INSTALL.md (reported line 46)May include surrounding context.
These libraries are required by the Firefox-based Camoufox binary to render pages correctly:

bash
sudo apt-get update && sudo apt-get install -y \ libgtk-3-0 \ libgdk-pixbuf2.0-0 \ libdbus-glib-1-2 \

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · INSTALL.md (reported line 82)May include surrounding context.
chmod +x /root/.cache/camoufox/camoufox

Cleanup

rm -f /tmp/camoufox.tar.gz

text
If you need a specific version, replace `latest` with e.g. `v0.0.1`.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · INSTALL.md (reported line 93)May include surrounding context.
d/camoufox-linux-amd64.tar.gz"

Extract

tar xzf /tmp/camoufox.tar.gz -C /root/.cache/camoufox/ chmod +x /root/.cache/camoufox/camoufox

Cleanup

rm -f /tmp/camoufox.tar.gz

text
If you need a specific version, replace `latest` with e.g. `v0.0.1`. ### Step 3: Set Environment Variables The OpenClaw plugin needs to know where the Camoufox binary lives: ```bash # Add to ~/.bashrc for persistence echo 'export CAMOUFOX_EXECUTABLE=/root/.cache/camoufox/camoufox' >> ~/.bashrc source ~/.bashrc # Verify it's set echo $CAMOUFOX_EXECUTABLE

Optional but recommended environment variables:

Variable Default Description
CAMOUFOX_EXECUTABLE unset Path to camoufox binary (required)
CAMOUFOX_API_KEY none API key for authenticated features (cookie import)
CAMOUFOX_CRASH_REPORT_ENABLED true Set false to disable anonymized crash telemetry

Step 4: Install OpenClaw Plugin

Place the skill in the OpenClaw skills direct

Variable	Default	Description
`CAMOUFOX_EXECUTABLE`	unset	Path to camoufox binary (required)
`CAMOUFOX_API_KEY`	none	API key for authenticated features (cookie import)
`CAMOUFOX_CRASH_REPORT_ENABLED`	true	Set `false` to disable anonymized crash telemetry

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · INSTALL.md (reported line 251)May include surrounding context.
bash
# Create a test tab curl -X POST http://localhost:9377/tab/create \ -H "Content-Type: application/json" \ -d '{"url": "https://www.example.com"}'

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · INSTALL.md (reported line 264)May include surrounding context.
List Tabs

bash
curl -s http://localhost:9377/tabs/list | python3 -m json.tool

Common Installation Issues

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 94% confidence
Finding: This is the specific high-risk uninstall deletion of the cached Camoufox binary directory. While legitimate for removal, it is still destructive and should be clearly flagged to prevent accidental data loss.
Content: Scanner excerpt · INSTALL.md (reported line 291)May include surrounding context.
md
pkill -f "camoufox" 2>/dev/null # Remove the binary rm -rf /root/.cache/camoufox/ # Remove the skill directory rm -rf ~/.openclaw/workspace/skills/camofox-default-browser/

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 94% confidence
Finding: This is the specific high-risk uninstall deletion of the cached Camoufox binary directory. While legitimate for removal, it is still destructive and should be clearly flagged to prevent accidental data loss.
Content: Scanner excerpt · INSTALL.md (reported line 291)May include surrounding context.
md
pkill -f "camoufox" 2>/dev/null # Remove the binary rm -rf /root/.cache/camoufox/ # Remove the skill directory rm -rf ~/.openclaw/workspace/skills/camofox-default-browser/

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 94% confidence
Finding: This is the specific recursive deletion of the installed skill directory under the user's home directory. It is valid uninstall behavior but should not be presented without clear warnings and confirmation guidance because it can permanently remove local changes.
Content: Scanner excerpt · INSTALL.md (reported line 294)May include surrounding context.
md
rm -rf /root/.cache/camoufox/ # Remove the skill directory rm -rf ~/.openclaw/workspace/skills/camofox-default-browser/ # Remove environment variable from bashrc sed -i '/export CAMOUFOX_EXECUTABLE/d' ~/.bashrc

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 94% confidence
Finding: This is the specific recursive deletion of the installed skill directory under the user's home directory. It is valid uninstall behavior but should not be presented without clear warnings and confirmation guidance because it can permanently remove local changes.
Content: Scanner excerpt · INSTALL.md (reported line 294)May include surrounding context.
md
rm -rf /root/.cache/camoufox/ # Remove the skill directory rm -rf ~/.openclaw/workspace/skills/camofox-default-browser/ # Remove environment variable from bashrc sed -i '/export CAMOUFOX_EXECUTABLE/d' ~/.bashrc

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · INSTALL.md (reported line 235)May include surrounding context.
bash
# Basic health check curl -s http://localhost:9377/health | python3 -m json.tool # Expected response fields: status, uptime, tabs, memory_mb, version # status should always be "ok"

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · PERFORMANCE.md (reported line 226)May include surrounding context.
bash
# Basic health check curl -s http://localhost:9377/health | python3 -m json.tool # Expected response fields: status, uptime, tabs, memory_mb, version # status should always be "ok"

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · TROUBLESHOOTING.md (reported line 442)May include surrounding context.
bash
# Basic health check curl -s http://localhost:9377/health | python3 -m json.tool # Expected response fields: status, uptime, tabs, memory_mb, version # status should always be "ok"

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SECURITY.md (reported line 31)May include surrounding context.
md
Store .txt/.cookies files outside Leave them in world-readable /tmp public web root directories Set file permissions 600 (owner only) chmod 777 for convenience Use dedicated files per account Mix multiple accounts in one file

Credential Access

High

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SECURITY.md (reported line 60)May include surrounding context.
md
1. **Rotate regularly** — Replace cookies every time login credentials change or suspicious activity is detected. 2. **Scope minimally** — Import only what you need. Use `domainSuffix` filter instead of bulk imports. 3. **Segregate by purpose** — Separate work, personal, and testing cookies into different files. 4. **Never commit to version control** — Add `*.cookies`, `*cookies.txt`, `*.netrc` to `.gitignore` immediately. ---

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · TROUBLESHOOTING.md (reported line 87)May include surrounding context.
Clean any stale socket files that may linger:

bash
rm -f /tmp/camofox-server.sock

Restart the server:

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · FAQ.md (reported line 152)May include surrounding context.
Clear corrupted browser cache:

bash
rm -rf /root/.cache/camoufox/cache-*

Check crash logs for specifics:

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · TROUBLESHOOTING.md (reported line 125)May include surrounding context.
Clear corrupted browser cache:

bash
rm -rf /root/.cache/camoufox/cache-*

Check crash logs for specifics:

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · TROUBLESHOOTING.md (reported line 125)May include surrounding context.
Clear corrupted browser cache:

bash
rm -rf /root/.cache/camoufox/cache-*

Check crash logs for specifics:

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly promotes anti-detection browsing to bypass WAFs, CAPTCHAs, and bot blocking, which materially increases the ability to evade site security controls. In an agent skill, normalizing these capabilities creates a misuse-ready pathway for unauthorized scraping, account abuse, or policy circumvention beyond ordinary browser automation.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill frames evasive browsing against anti-bot defenses as a standard, preferred workflow for external websites. That normalizes security-control circumvention and increases the likelihood that agents will apply stealth tooling broadly, including in contexts where the operator lacks authorization.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Describing cookie-authenticated sessions without warning that cookies are equivalent to bearer credentials can lead operators or downstream agents to treat sensitive session material casually. In this context, imported cookies could grant direct access to private accounts and data if mishandled, logged, or reused across tasks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Documenting arbitrary JavaScript execution in page context without guardrails increases the risk of unsafe scripted actions, data extraction, and abuse of authenticated web application state. In an agent setting, this capability can be used to invoke app APIs, manipulate DOM state, or exfiltrate sensitive page content with little friction.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: CONFIGURATION.md:26

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

SkillSpector

Privileged Container / Container Escape

Credential Access

Example .env Snippet

Tool Parameter Abuse

Chaining Abuse

Tool Parameter Abuse

Cleanup

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

Extract

Cleanup

Step 4: Install OpenClaw Plugin

External Script Fetching

External Script Fetching

List Tabs

Common Installation Issues

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

External Script Fetching

External Script Fetching

External Script Fetching

Tool Parameter Abuse

Credential Access

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Context-Inappropriate Capability

Ssd 4

Missing User Warnings

Missing User Warnings

Static analysis

File appears to expose a hardcoded API secret or token.

Example `.env` Snippet