Security audit

Browser Search

Security checks for vulnerabilities and agentic risk

Overview

This browser-research skill is mostly coherent, but it exposes unsafe bypass modes, persistent container setup, and sensitive browser/session controls that need review before installation.

Install only if you trust the Camofox/CloakBrowser components and are comfortable with an agent controlling a local browser service. Avoid `--unsafe`, avoid persistent profiles unless explicitly needed, do not put proxy passwords directly in commands, pin and verify any Docker image before running it, and keep API/admin keys narrowly scoped.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:352
Finding: Security Controls Can Be Disabled Through the CloakBrowser Unsafe Mode
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:289
Finding: Mutable and Unqualified Docker Image Creates a Supply-Chain Execution Risk
Content: View full analysis
.env docker run -d --name camofox-browser --restart unless-stopped \ -p 127.0.0.1:9377:9377 \ --env-file .env \ camofox-browser:latest ``` ### Technical Analysis The Docker image name is unqualified and uses the mutable `latest` tag. The instructions do not identify: - A trusted registry - The expected publisher or namespace - An immutable image digest - A verified signature - A software bill of materials - A reproducible build source An unqualified image name may resolve according to local Docker registry configuration, while `latest` can point to different content over time. The code executed by a future installation can therefore differ from the artifact that was originally reviewed. The container also receives the `.env` file containing `CAMOFOX_API_KEY`, has network access, and is configured with `--restart unless-stopped`. A substituted image could read that secret, communicate externally, and continue restarting across sessions. ### Attack Path 1. The expected `camofox-browser` image does not exist locally. 2. An operator or automation follows the documented `docker run` command. 3. Docker resolves or retrieves the unqualified `camofox-browser:latest` image using the host's configured registry behavior. 4. A compromised, replaced, or attacker-controlled image is started. 5. The image receives environment variables from `.env`, including the Camofox API key. 6. Malicious startup code reads the secret, performs network activity, or exposes a spoofed local browser API. 7. The `--restart unless-stopped` policy causes the container to restart after daemon or host restart ...[truncated 649 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:323
Finding: Proxy Credentials Are Embedded in Command-Line Arguments
Content: View full analysis
/scripts/cloak/cloak-fetch.mjs "https://..." --proxy "socks5://user:pass@proxy:1080" --geoip ``` A similar credential-bearing proxy argument is shown for complex interactions: ```bash exec node /scripts/cloak/cloak-script.mjs \ --script "/scripts/cloak/scripts/.mjs" \ --proxy "socks5://..." --seed 12345 ``` ### Technical Analysis The documented interface places the proxy URL directly in the process argument list. When the URL contains a username and password, the credentials can be exposed through: - Process inspection utilities - Shell history - Agent execution transcripts - Command telemetry and audit logs - Error reports - CI/CD logs - Debugging output This pattern conflicts with the Skill's separate instruction not to place API keys on the command line. Proxy passwords are also credentials and require equivalent protection. The issue does not prove that credentials are transmitted to an unrelated external recipient. The proxy necessarily receives its own authentication information, but the command-line handling creates additional unintended local and logging exposure. ### Attack Path 1. A user supplies a proxy URL containing reusable credentials. 2. The agent inserts that URL into the documented `--proxy` argument. 3. The command is recorded in a transcript, shell history, process list, telemetry event, or diagnostic log. 4. A local user, administrator, monitoring system, or party with access to retained logs retrieves the plaintext proxy credentials. 5. The exposed credentials are reused to consume the proxy service, impersonate the account, or access resources authorized to that proxy identity. # ...[truncated 490 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (17)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: The documented ability to delete session traces is a destructive capability that can affect forensic visibility and debugging artifacts. In an agent-accessible skill, this increases the chance of evidence removal or accidental deletion of operational records.
Content: Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.
API_KEY="${CAMOFOX_API_KEY}"

text
The API key (Bearer) is required for `POST /evaluate`, `POST /sessions/{userId}/cookies`, `DELETE /sessions/{userId}`, `GET /sessions/{userId}/traces`, `DELETE /sessions/{userId}/traces/{filename}`, and `POST /pressure/cleanup`. `POST /stop` requires `x-admin-key` header (see below). Other endpoints work without auth. **General pattern:**

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: The documented ability to delete session traces is a destructive capability that can affect forensic visibility and debugging artifacts. In an agent-accessible skill, this increases the chance of evidence removal or accidental deletion of operational records.
Content: Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.
API_KEY="${CAMOFOX_API_KEY}"

text
The API key (Bearer) is required for `POST /evaluate`, `POST /sessions/{userId}/cookies`, `DELETE /sessions/{userId}`, `GET /sessions/{userId}/traces`, `DELETE /sessions/{userId}/traces/{filename}`, and `POST /pressure/cleanup`. `POST /stop` requires `x-admin-key` header (see below). Other endpoints work without auth. **General pattern:**

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.
md
1. **Create tab** → `POST /tabs` → get `tabId` (+ initial snapshot) 2. **Operate** on the tab with snapshot, evaluate, click, scroll... 3. **Close tab** → `DELETE /tabs/{tabId}` > **TabId persistence:** Always keep the `tabId` between commands. Camofox commands must never run in isolation: create a tab, use the `tabId` for all subsequent operations, then close it. >

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 292)May include surrounding context.
bash
docker start camofox-browser # If doesn't exist (⚠️ use --env-file for API keys, bind to 127.0.0.1): # Create .env file first: echo "CAMOFOX_API_KEY=your-key" > .env docker run -d --name camofox-browser --restart unless-stopped \ -p 127.0.0.1:9377:9377 \ --env-file .env \

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 295)May include surrounding context.
bash
docker start camofox-browser # If doesn't exist (⚠️ use --env-file for API keys, bind to 127.0.0.1): # Create .env file first: echo "CAMOFOX_API_KEY=your-key" > .env docker run -d --name camofox-browser --restart unless-stopped \ -p 127.0.0.1:9377:9377 \ --env-file .env \

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly documents an --unsafe mode that bypasses SSRF protection, sandboxing, and path-traversal checks, even though the skill's purpose is ordinary web research. In an agent setting, exposing a one-flag bypass for multiple security boundaries materially increases the chance of internal-network access, local file/script abuse, or execution beyond intended constraints.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation guidance says to use the skill whenever web research is needed, which is overly broad for a capability that includes arbitrary page evaluation, browser automation, admin endpoints, proxies, and protected-site tooling. Broad routing increases the odds that the agent invokes higher-risk tooling unnecessarily, expanding exposure to data transmission and misuse paths.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The core rules prohibit browsing Instagram, Facebook, TikTok, LinkedIn, and Twitter/X with Camofox or CloakBrowser, yet the Camofox macro table later includes @linkedin_search, @twitter_search, @instagram_search, and @tiktok_search. This is an active contradiction in the skill's own guidance about intended usage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documentation includes authenticated requests involving cookies, traces, and session operations, but does not prominently warn that using them may transmit or manipulate authentication/session data. In an agent context, that omission can lead to accidental handling of sensitive tokens or cookies without informed consent or clear scoping.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.
bash
# 1. Create tab and navigate → returns { tabId, url } (snapshot separate) exec curl -s -X POST "http://localhost:9377/tabs" \ -H 'Content-Type: application/json' \ -d "{\"userId\":\"$USER_ID\",\"sessionKey\":\"$SESSION_KEY\",\"url\":\"<url>\"}"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: This endpoint allows arbitrary JavaScript expressions to be sent to the browser evaluation API, authenticated with a bearer token. In context, that creates a powerful remote code/DOM execution surface inside the browsing environment, which can be abused for unauthorized data extraction, unsafe interactions, or expansion of impact if paired with weaker sandboxing or the documented --unsafe bypasses.
Content: Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.
md
# Options: &includeScreenshot=true | &offset=N (pagination) # 3. Evaluate (arbitrary JavaScript — for HTML tables, <code>, <pre>, non-ARIA divs) exec curl -s -X POST "http://localhost:9377/tabs/<tabId>/evaluate" \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $API_KEY" \ -d "{\"userId\":\"$USER_ID\",\"expression\":\"<js-expression>\"}"

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documented /stop admin endpoint allows terminating the browser service, which is unrelated to normal web research and gives the agent operational control over shared infrastructure. If misused, it can disrupt other sessions, destroy availability, and interfere with auditing or ongoing tasks.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 246)May include surrounding context.
bash
# 1. Create tab exec curl -s -X POST "http://localhost:9377/tabs" \ -H 'Content-Type: application/json' \ -d '{"userId":"$USER_ID","sessionKey":"$SESSION_KEY","url":"https://example.com"}' # → {"tabId":"abc123","url":"https://example.com/"}

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.
md
-d '{"userId":"$USER_ID","expression":"document.querySelector(\"main\")?.innerHTML || document.body.innerHTML"}' # 4. Interact: scroll, click, type... exec curl -s -X POST "http://localhost:9377/tabs/abc123/scroll" \ -H 'Content-Type: application/json' \ -d '{"userId":"$USER_ID","direction":"down","amount":500}'

Rp1

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill documents proxy usage for browsing protected sites without a strong warning that page contents, queries, and possibly session traffic may traverse third-party infrastructure. That can create confidentiality and compliance risks, especially when an agent may browse user-specified targets or carry cookies/session state.
Content: No source excerpt is available for this finding.

Ssd 1

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The document frames --unsafe as an available expert option while acknowledging it bypasses SSRF, sandbox, and path-traversal protections. Presenting a consolidated safety bypass in normal documentation semantically normalizes dangerous behavior and makes it easier for an agent to justify crossing boundaries that should remain hard security limits.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical

Code: suspicious.generated_source_template_injection
Location: SKILL.md:95