cloakbrowser-stealth

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.1

Overview

This skill is built to bypass website anti-bot defenses and scrape protected pages, with proxy and humanization guidance but little authorization scoping.

Install only if you have explicit authorization to automate the target sites and you are comfortable with a stealth browser dependency, proxy-capable scraping, and local capture of page contents. Run it in an isolated environment with controlled network egress, avoid untrusted URLs, do not use it to evade third-party access controls or site policies, and clean up screenshots or browser profiles that may contain sensitive data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: references/config.md:8

Finding

Unpinned Third-Party Browser Dependency Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: references/config.md, line 8
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code:

bash

pip install cloakbrowser

Technical Analysis

The documented installation command retrieves the currently published version of cloakbrowser without pinning a reviewed version or verifying package hashes. The project also contains no dependency lock file or hash manifest.

Python package installation may execute package-controlled build or installation logic. Consequently, a compromised, malicious, or unexpectedly changed future package release could execute code with the privileges of the user performing the installation. The effective dependency contents can change without any corresponding modification to this repository.

This is a supply-chain weakness rather than evidence that the currently published dependency is malicious.

Attack Path

1. An attacker compromises the dependency's package registry account, distribution infrastructure, or a future release.
2. The attacker publishes a modified cloakbrowser package containing malicious installation or runtime code.
3. A user follows the documented pip install cloakbrowser command.
4. pip downloads the attacker-controlled release because no exact version or integrity hash is required.
5. Malicious code executes during installation or when scripts/fetch.py imports and invokes the package.

Impact Assessment

Exploited package code would run with the privileges of the user installing or executing the skill. It could access that user's files, environment variables, browser data, network connectivity, and other resources available to the Python process. If installation is performed with elevated privileges, the impact could extend to system-wide compromise.

Remediation

View remediation

Remediation Suggestions

• Pin cloakbrowser to an exact, reviewed version instead of installing the latest available release.
• Record all transitive dependencies in a lock file.
• Require cryptographic hashes during installation, such as with a hash-locked requirements file and pip install --require-hashes.
• Document the trusted package index or verified upstream source.
• Install the dependency in an isolated, least-privileged virtual environment.
• Add automated dependency vulnerability and provenance checks to the release process.
• Review and deliberately approve dependency upgrades before changing the pinned version.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fetch.py:47

Finding

Unrestricted Browser Navigation Permits Server-Side Request Forgery

Content

View full analysis

Vulnerability Details

File Location: scripts/fetch.py, lines 47 and 69
Vulnerability Type: Unrestricted URL navigation and internal-network access
Risk Level: Medium

Vulnerable Code:

python

parser.add_argument("url", help="Target URL")

python

page.goto(args.url, wait_until=args.wait_until, timeout=45000)

The resulting response content is subsequently extracted and returned:

python

else:
    result["text"] = page.inner_text("body")[:args.max_chars]
    result["html"] = page.content()[:args.max_chars * 2]

Technical Analysis

The user-controlled URL is passed directly to the browser without validating its scheme, hostname, resolved IP address, port, or redirect destinations. There is no allowlist and no rejection of loopback, link-local, private, reserved, or cloud metadata address ranges.

Because the browser makes requests from the environment running the skill, it may have access to network resources that are inaccessible to the party supplying the URL. The script then extracts response text or HTML and prints it, creating a response-disclosure channel.

Browser navigation and redirect behavior must both be restricted. Validating only the original hostname would remain vulnerable to redirects and DNS rebinding if the resolved destination is not checked at request time.

Attack Path

1. An attacker or untrusted task input causes the agent to invoke the skill with a URL targeting an internal resource, such as a loopback service, private-network administration interface, or cloud metadata endpoint.
2. argparse accepts the URL without validation.
3. page.goto requests the resource using the agent host's network access.
4. If the endpoint returns browser-readable content, the script extracts its body text and HTML.
5. The extracted content is printed as text, HTML, or JSON and may be exposed in agent output.
6. The attacker can repeat the process with dif ...[truncated 755 chars]

Remediation

View remediation

Remediation Suggestions

• Allow only explicitly required URL schemes, normally https and, if necessary, http.
• Prefer an explicit hostname or domain allowlist for approved scraping targets.
• Resolve hostnames before navigation and reject loopback, link-local, private, multicast, unspecified, reserved, and documentation address ranges for both IPv4 and IPv6.
• Validate every redirect destination using the same policy before allowing the browser to continue.
• Protect against DNS rebinding by verifying the actual connection destination, not only an earlier DNS lookup.
• Block access to cloud metadata services and internal address ranges at the network or container boundary as defense in depth.
• Restrict unnecessary ports and consider running the browser in an isolated network namespace with controlled egress.
• Apply the checks to all browser subresource requests if untrusted pages must not contact internal services.
• Return a clear validation error without navigating when a destination violates the policy.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Ssd 2

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is explicitly marketed as stealth browser automation to bypass bot detection, CAPTCHA-related access controls, and access-denied responses on protected sites. That frames the tool as a mechanism for evading defensive controls on third-party websites, which increases the likelihood of unauthorized scraping, policy violations, and abuse at scale.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation instructs users to save screenshots to local disk but does not warn that screenshots can capture sensitive on-page data or that files will persist on the host. In an agent or multi-tenant environment, this can lead to unintended local data retention and later disclosure of scraped content, session details, or personal information.

Content

No source excerpt is available for this finding.

Ssd 2

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The example command explicitly recommends 'humanize' behavior for aggressive detection, which is a classic evasion technique intended to reduce the chance that automated access is identified. Concrete operational guidance like this lowers the barrier to misuse and directly supports circumvention of website defenses.

Content

No source excerpt is available for this finding.

Ssd 2

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The guidance explicitly says the tool works against fingerprint detection and advises using proxies for IP-reputation blocks, which amounts to operational instructions for defeating multiple layers of anti-abuse controls. In context, this is more dangerous because the overall skill is purpose-built for accessing protected sites after ordinary fetching fails due to defensive measures.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This documentation explicitly promotes anti-detection browser automation, fingerprint spoofing, and proxy-based geo/timezone matching to evade site defenses. In the context of a skill whose stated purpose is to bypass anti-bot protections on protected sites, the absence of warnings or restrictions is not merely incomplete documentation—it materially facilitates abuse, scraping against site policies, and evasive access patterns.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script writes a full-page screenshot to a user-supplied path when --screenshot is provided, but there is no confirmation prompt or explicit warning that it will create or overwrite a local file containing page contents. The CLI help says it will 'Save full-page screenshot', but it does not disclose the potential sensitivity of captured page data or overwrite implications.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.