Web Freedom Toolkit

• Outcome: Review
• Latest audit: May 29, 2026 · 9:24 PM UTC
• Version: 8.0.0

Overview

This skill appears to be a stealth-oriented web automation toolkit with browser takeover and local relay capabilities that are broader and riskier than ordinary web fetching.

Install only if you intentionally need a high-risk browser automation tool and can run it in an isolated environment. Do not use it with a browser profile containing accounts or cookies, and review the scripts for DevTools attachment, local port forwarding, no-sandbox Chromium use, outbound query destinations, and file writes before enabling it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill advertises and appears to require powerful capabilities including network, shell, file access, and environment access, yet declares no explicit permissions or constraints. This creates a dangerous trust gap where an operator may approve the skill as low-risk while it can actually execute broad local actions and outbound communications.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The described behavior goes well beyond a normal web-fetching toolkit and includes tunneling, socket-based handshake logic, subprocess launching with modified environments, DevTools takeover, and low-level browser injection. In the context of repeated stealth/undetectable framing, this strongly suggests concealed control channels and evasion-oriented capabilities that could be abused for unauthorized access, persistence, proxying, or covert browsing activity.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The script exposes a high-privilege "page takeover" capability that is unrelated to the declared purpose of a web browsing/fetching toolkit, which is a strong indicator of hidden or unauthorized functionality. The presence of a vague access-control check does not mitigate the risk, because the operation itself appears designed for takeover rather than legitimate browsing and could be abused for unauthorized control actions.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: A takeover feature embedded in a toolkit marketed for undetectable browsing/fetching materially increases the danger because the surrounding context already emphasizes stealth and restricted-environment operation. That mismatch suggests the capability may be concealed behind an innocuous description, enabling unauthorized page control or account/session abuse under the cover of a benign-seeming web automation tool.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: This script implements a direct Chrome DevTools Protocol connection to a local debugger endpoint and labels it a "takeover," which enables control over an existing browser context rather than performing ordinary web fetching. In the context of a server-side browsing toolkit advertised as "undetectable" and designed for restricted environments, this capability can be used to hijack authenticated sessions, inspect page data, or issue browser commands against another process, making it substantially more dangerous than the stated purpose.

Intent-Code Divergence

Low

• Confidence: 90% confidence
• Finding: The code presents the operation as safeguarded by a "mandatory" handshake, but the actual protection shown is only a local pre-check before connecting to whatever debugger is exposed on the fixed port. That framing can create a false sense of safety while still allowing attachment to an unrelated local browser debugging service, which weakens trust boundaries and makes misuse easier in multi-process or shared environments.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This code directly attaches to a local Chrome DevTools endpoint and issues low-level browser commands through BrowserDriver, enabling arbitrary page navigation and script evaluation in an existing browser context. In a server-side 'web freedom' skill, that capability is more dangerous than ordinary fetching because it can inherit authenticated browser state, interact with local debugging services, and bypass higher-level safety boundaries intended for normal web access.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The code claims to require 'explicit human authorization,' but the only control is a static environment variable check, which is not proof of contemporaneous user approval and can be pre-set by deployment configuration or another process. This creates a misleading safety gate that may cause operators to overtrust execution of a highly privileged browser-control path.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This file implements a localhost TCP relay that forwards traffic from 127.0.0.1:9223 to 127.0.0.1:9222, but that capability is not transparently described in the skill metadata. In the context of a toolkit explicitly advertising 'undetectable browsing' and operation on restricted environments, an undisclosed relay can be used to expose or proxy sensitive local services such as browser debugging endpoints, increasing the risk of stealthy lateral access or policy evasion.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The script deliberately targets a specific anti-bot vendor site and uses TLS/browser impersonation while framing the activity as a 'breach.' Even though the actual behavior is only a GET request against a public page, the combination of anti-detection tooling, target selection, and adversarial framing makes this a risky capability that can normalize or facilitate unauthorized evasion testing beyond the stated toolkit purpose.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The code exaggerates a routine public-page fetch as a successful 'breach,' which is misleading and can encourage operators to treat anti-bot evasion as an intended offensive use case. While the code does not itself exploit a system, the deceptive messaging increases the likelihood of misuse and obscures the true security posture of the skill.

Context-Inappropriate Capability

Low

• Confidence: 78% confidence
• Finding: The script writes a local 'proof' artifact recording successful access to a named target, which can create unnecessary evidence logs of potentially questionable activity. In a toolkit positioned around stealthy or restricted-environment browsing, retaining such artifacts increases operational risk and can support misuse workflows without a clear legitimate need.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The markdown explicitly promotes stealth, impersonation, and bypass of Cloudflare/WAF controls without warning about legal, privacy, or network-security implications. This normalizes evasive behavior and increases the likelihood that users will deploy the skill in ways that violate acceptable-use policies or target protected services.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: Launching Chromium with '--no-sandbox' removes a major browser security boundary, so any malicious web content reached through this tool executes in a much weaker containment model. In this skill's context, which explicitly promotes 'undetectable browsing' and interaction with restricted or defended sites, the browser is more likely to process hostile pages, making sandbox removal materially more dangerous.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The code sends the user-supplied query to third-party services (arXiv and DuckDuckGo) without explicit consent, disclosure, or controls around sensitive input. If users provide proprietary, personal, or otherwise confidential search terms, that data is exposed to external services and network observers, creating a privacy and data-handling risk.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The script writes retrieved results to a predictable local JSON file without notifying the user about retention, location, or access expectations. On shared systems or restricted VPS environments, this can leave behind potentially sensitive research topics or operational traces that other users or processes may read.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The code treats `SOTA_INTERNAL_AUTH=TRUE` as an authentication marker and injects it into the child process environment, but environment variables are not a trustworthy authentication boundary. Any process able to invoke the child script directly can typically set the same variable, so downstream code that relies on this flag for authorization can be bypassed.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code silently writes a file to disk without prior notice or confirmation, which is a real safety and transparency issue for an agent skill. Undisclosed persistence can surprise users, leak data into the working directory, and create audit or privacy concerns, especially when the file documents access to a specific external target.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.