Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent browser-control helper, but it exposes powerful browser-session and script-evaluation capabilities without enough scoping or user-consent guidance.
Install only if you intentionally need high-trust browser automation against a known camofox-browser server. Treat cookies and storage_state as login credentials, avoid using /evaluate on sensitive authenticated pages unless explicitly necessary, and keep --base pointed at a server you control.
The documented behavior understates the skill's effective power by not prominently declaring arbitrary script execution via /evaluate and browser state import/export capabilities. This mismatch is dangerous because reviewers and users may authorize what appears to be routine browser automation while the skill can access, manipulate, or exfiltrate authenticated browser data and execute custom logic in page context.
The skill instructs the agent to interact with a local or remote HTTP service and therefore clearly uses network capabilities, but it declares no explicit tool scope or permission boundaries. That omission weakens transparency and enforcement, making it easier for the skill to be invoked in contexts where network access is unexpected or insufficiently reviewed.
The skill description promotes exporting storage state and importing cookies without warning that these actions handle highly sensitive session artifacts. In practice, such artifacts can enable session hijacking, cross-account access, or persistence of authenticated state if mishandled or sent to an unintended service.
The skill exposes an /evaluate escape hatch that can run arbitrary expressions in the browser tab, but the description does not clearly warn about this high-risk capability. Script evaluation in page context can read page state, interact with authenticated sessions, extract tokens or PII visible to the page, and bypass safer ref-based interaction patterns.
The cheatsheet exposes a browser endpoint that can execute arbitrary JavaScript in the context of any page loaded in the controlled tab. That materially expands the skill from UI-style browser control into script execution, enabling access to page DOM, tokens, and sensitive in-session data, especially when paired with authenticated browsing sessions.
The cheatsheet documents cookie import and storage-state export, which directly enable injection or extraction of authenticated session material. Without prominent warnings and strict handling requirements, users or downstream agents may treat these as routine browser actions and inadvertently exfiltrate or reuse sensitive credentials across contexts.
The evaluate subcommand exposes arbitrary JavaScript execution in the controlled browser tab by directly forwarding user-supplied expression values to the backend /evaluate endpoint. In a browser-control skill, this is more powerful than ordinary navigation, clicking, typing, or snapshotting because it enables unrestricted DOM/script interaction, data extraction, and potentially abuse of any authenticated browser context available to the remote service.
