CamoFox MCP

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:49 PM UTC
• Version: 1.10.0

Overview

This skill openly provides powerful stealth browser automation, but its authenticated-session, profile, download, deletion, JavaScript, and external package execution capabilities need careful review before installation.

Install only if you intend to give an agent stealth browser-control capabilities. Use it with accounts and cookies you are authorized to access, run it in a constrained environment, review the upstream npm package before use, avoid importing sensitive cookies casually, and understand where downloads and saved profiles are stored and deleted.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: setup.sh:5

Finding

Unverified Third-Party npm Package Execution via npx

Content

View full analysis

Vulnerability Details

File Location: setup.sh:5; additionally documented in SKILL.md:47, SKILL.md:55, and manifest.yaml:25
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable code in setup.sh:1-5:

bash

#!/bin/bash
echo "Starting CamoFox MCP in HTTP mode..."
echo "Ensure CamoFox Browser is running on port 9377"
echo ""
CAMOFOX_TRANSPORT=http npx camofox-mcp@1.10.0

Related commands in SKILL.md:

bash

CAMOFOX_TRANSPORT=http npx camofox-mcp@1.10.0

bash

npx @filiksyos/mcptoskill http://localhost:3000/mcp

Related declaration in manifest.yaml:

yaml

- name: Start command
  required: true
  description: Start MCP server with CAMOFOX_TRANSPORT=http npx camofox-mcp@1.10.0

Technical Analysis

The setup script uses npx to resolve and immediately execute the external npm package camofox-mcp@1.10.0. Although this package is pinned to an exact version, the project does not include a lockfile, integrity hash, signature verification, vendored source, or other mechanism that allows the downloaded artifact to be verified before execution.

The alternative command in SKILL.md executes @filiksyos/mcptoskill without specifying any version, creating additional version drift and supply-chain exposure. Depending on the local npm and npx configuration, missing packages can be downloaded from the configured npm registry and their package code or lifecycle behavior executed with the current user's privileges.

The supplied project does not contain evidence that either dependency is malicious. The weakness is that the effective executable implementation resides outside the audited artifact and is trusted without local integrity enforcement.

Attack Path

1. An attacker compromises an upstream npm package, its publisher account, the configured package registry, or another relevant dependency-distribution component.

...[truncated 1206 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a reviewed package.json and lockfile, and install dependencies using an integrity-enforcing command such as npm ci.
2. Execute the package from the verified local installation rather than allowing npx to download it dynamically. If npx remains necessary, use npx --no-install after installation.
3. Pin every executable dependency to an exact reviewed version, including @filiksyos/mcptoskill.
4. Record and validate expected package integrity hashes and explicitly configure the trusted npm registry.
5. Audit package source, transitive dependencies, lifecycle scripts, and published artifacts before approving updates.
6. Run the MCP service as a dedicated, minimally privileged account or inside a restricted container with limited filesystem, credential, and network access.
7. Use automated dependency monitoring and require review before changing locked dependency versions or integrity metadata.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill advertises cookie import, session persistence, downloads, inline file retrieval, profile storage, and file deletion, but it does not warn about handling authenticated data, local disk effects, retention, or privacy/security boundaries. In context, this is more dangerous because the same skill is built for stealth browser automation, making covert collection, persistence, and removal of evidence more feasible if misused.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrases are very broad and map to common browsing, extraction, login, search, persistence, and download tasks without meaningful scope limits or safety qualifiers. In an agent environment, this increases the chance the skill is invoked for sensitive websites or high-risk automation flows by default, especially because the skill is explicitly designed for stealth and anti-detection use on sites that resist automation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest advertises extensive anti-detection browser automation, cookie import/export, profile persistence, downloads, screenshots, JavaScript execution, and stealth search capabilities, but provides no user-facing warning, consent model, or policy constraints around privacy-sensitive and potentially destructive actions. In an agent-executable skill, this omission increases the risk of covert account access, scraping, session hijacking, or exfiltration because operators may invoke powerful actions without clear disclosure of what data can be accessed or retained.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.