camofox-default-browser

• Outcome: Review
• Latest audit: Jul 30, 2026 · 9:28 AM UTC
• Version: 1.1.2

Overview

This is a high-power anti-detection browser automation skill with cookie-session reuse and some under-scoped access controls, so it should go through Review before installation.

Install only if you explicitly need authorized anti-detection browser automation. Before use, bind the server to localhost, set an API key for all sensitive operations through a gateway or reverse proxy, disable telemetry in sensitive environments, avoid exposing port 9377, keep cookie files at mode 600 outside /tmp, delete cookies after use, and confirm the target site's authorization and terms before automating.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documents and relies on shell-level system capabilities such as apt-get installation steps, environment variable setup, local binary execution, and a localhost service, but it declares no corresponding permissions. This creates a trust and enforcement gap: an agent or runtime may permit broader execution behavior than users expect, especially for a user-invocable skill that launches a browser automation stack with anti-detection features.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The API exposes a cookie-file import feature that enables direct use of authenticated browser sessions, which materially increases abuse potential beyond ordinary browser automation. In this skill context, importing Netscape-format cookies can facilitate session hijacking or unauthorized access if cookie files are obtained improperly, and the documentation does not constrain provenance, consent, or scope of use.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The documentation states that most endpoints require bearer authentication, but only the cookie import endpoint explicitly documents authorization enforcement. This inconsistency strongly suggests that high-risk browser-control functions such as navigation, screenshots, DOM snapshots, and JavaScript evaluation may be exposed without authentication, enabling unauthorized remote browser control and data access.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The FAQ first assures users that browsing data is not collected under normal operation, then discloses default-enabled crash telemetry that transmits metadata such as User-Agent, viewport, timestamps, and stack traces. Even if not full page content, this is still outbound data collection, and the inconsistent disclosure can mislead operators into enabling a browser automation component that sends data off-host without fully informed consent.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The installation guide explicitly promotes anti-bot bypass, CAPTCHA/Turnstile evasion, and scraping-protection circumvention. In the context of an agent skill, these capabilities materially increase abuse potential beyond ordinary browser automation by enabling stealthy interaction with protected services and reducing operator visibility into misuse.

Context-Inappropriate Capability

Low

• Confidence: 78% confidence
• Finding: Documented support for cookie import and persistent authentication expands the skill from simple browsing into session reuse and account-context automation. If exposed to an agent workflow, this can facilitate unauthorized account access, session hijacking, or covert use of stored authenticated state.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The guide explicitly recommends anti-detection behavior such as staggering operations to avoid detection signatures and rotating user-agent strings across tabs. Even if framed as performance tuning, this materially expands the skill from ordinary authorized automation into evasion-oriented operational guidance that can facilitate stealthy misuse against third-party sites.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The quick tuning checklist includes a goal of maximizing anti-detection safety with random delays and constrained tab behavior, which promotes evasion tactics not necessary for standard browser automation. In context, this normalizes stealth-focused usage without documenting legal, contractual, or authorization boundaries.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill explicitly supports importing Netscape-format cookies for authenticated browsing but does not warn about the sensitivity of session cookies, the need for explicit user authorization, or the risk of account takeover if cookies are mishandled. In a browser-automation skill designed to bypass anti-bot protections, this omission is more dangerous because it normalizes using live authenticated sessions on third-party sites without clear privacy and consent guardrails.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: Snapshot and screenshot endpoints can capture page contents, including sensitive information visible in authenticated sessions, but the API reference does not clearly warn users about privacy and data-handling risks. In a browser automation skill with anti-detection features, this omission increases the chance of covert collection or mishandling of sensitive visual and accessibility data.

Missing User Warnings

High

• Confidence: 92% confidence
• Finding: The cookie import endpoint handles authenticated session material but lacks a prominent user-facing warning that uploaded cookies may provide full account access and must only be used with explicit authorization. Given this skill's anti-bot and browser automation positioning, inadequate warning and guardrails make misuse significantly more dangerous.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The example instructs users to export authentication cookies and save them to `/tmp/cookies.txt`, which is a common world-accessible or weakly protected temporary location on many systems. Session cookies are bearer tokens, so if another local user, process, backup agent, or malware reads that file before deletion, it can hijack the authenticated session and gain full account access.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: This skill is explicitly designed for anti-detection automation against major platforms with aggressive bot defenses, yet the documentation does not place a prominent upfront warning near the capability description that use may violate site rules or trigger account restrictions. In this context, the omission materially increases misuse risk because the tool's core value proposition is evading detection rather than ordinary browser automation.

Missing User Warnings

Medium

• Confidence: 75% confidence
• Finding: The guide notes crash telemetry is enabled by default but does not clearly warn users what data may be transmitted or how to opt out before first use. That can lead to unintentional disclosure of operational metadata in environments handling sensitive browsing sessions.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The uninstallation section includes irreversible deletion commands against cache and skill directories without an explicit warning that data will be permanently removed. In operational environments, users may delete logs, cookies, or other artifacts needed for recovery or auditability.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Recommending rotation of user-agent strings is a form of identity and fingerprint manipulation that can support impersonation and bypass of site controls. Because the document gives no warning about policy sensitivity, authorization requirements, or abuse risk, it lowers the barrier to deceptive automation.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The language around avoiding detection signatures and anti-detection tuning is operationally prescriptive and lacks any balancing constraints on lawful, authorized use. In a skill explicitly marketed around anti-bot handling, undocumented evasion guidance is more dangerous because it can be directly applied to conceal abusive automation.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README explicitly advertises importing authenticated cookies and routing traffic through residential proxies, which materially increases the chance of account misuse, session hijacking, privacy violations, and abuse of third-party services. In the context of an automation skill designed to evade detection, the absence of strong warnings, guardrails, and acceptable-use constraints makes this a genuine security concern rather than a purely documentation issue.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README promotes bypassing bot detection, CAPTCHAs, and WAF protections on major websites while framing the browser as 'undetectable,' which meaningfully enables stealthy automation against protected targets. In this skill's context, that increases abuse potential for unauthorized scraping, account actions, and policy evasion, and the lack of explicit risk, authorization, and compliance warnings makes the documentation dangerous.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The troubleshooting guide includes destructive commands such as `kill -9`, `rm -f`, and `rm -rf` without guardrails, verification steps, or warnings about scoping mistakes. In an ops-style document, readers may copy-paste these commands and accidentally terminate unrelated processes or delete unintended files, causing service disruption or data loss.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide instructs users to inspect cookie files, loosen permissions with `chmod 644 cookies.txt`, and share diagnostic outputs, but it does not warn that cookies are bearer tokens and that logs or command output may contain authentication data or personal information. This creates a realistic risk of credential leakage, especially in a browser automation tool that explicitly handles imported session cookies.

External Script Fetching

Low

• Category: Supply Chain

Content

libgtk-3-0 libgdk-pixbuf2.0-0 libdbus-glib-1-2 \
    libxt6 libxcomposite1 libxdamage1 libxfixes3 libxrandr2 \
    libatk-bridge2.0-0 libdrm2 libgbm1 xvfb \
    curl wget ca-certificates gnupg \
    && rm -rf /var/lib/apt/lists/*

# Install Node.js 20 LTS

• Confidence: 87% confidence
• Finding: The Dockerfile pipes a remotely fetched setup script directly into bash, creating a supply-chain execution risk if the upstream endpoint, network path, or DNS is compromised. This is especially sensitive because the container is preparing a browser automation environment that may later handle credentials and authenticated sessions.

External Script Fetching

Low

• Category: Supply Chain

Content

libgtk-3-0 libgdk-pixbuf2.0-0 libdbus-glib-1-2 \
    libxt6 libxcomposite1 libxdamage1 libxfixes3 libxrandr2 \
    libatk-bridge2.0-0 libdrm2 libgbm1 xvfb \
    curl wget ca-certificates gnupg \
    && rm -rf /var/lib/apt/lists/*

# Install Node.js 20 LTS

• Confidence: 87% confidence
• Finding: The Dockerfile pipes a remotely fetched setup script directly into bash, creating a supply-chain execution risk if the upstream endpoint, network path, or DNS is compromised. This is especially sensitive because the container is preparing a browser automation environment that may later handle credentials and authenticated sessions.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: CONFIGURATION.md:26