Camofox Cloaked Browser

• Outcome: Pass
• Latest audit: May 30, 2026, 10:33 AM
• Version:
  1.3.3

Overview

This skill is a disclosed guide for using a local Camofox anti-detection browser server, with sensitive browser features documented rather than hidden.

Install only if you actually need cloaked browser automation. Keep the server on localhost unless you configure CAMOFOX_ACCESS_KEY, avoid importing cookies unless necessary, do not set CAMOFOX_URL globally in Hermes, and set CAMOFOX_CRASH_REPORT_ENABLED=false for privacy-sensitive browsing.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README notes that crash/hang telemetry can be disabled via `CAMOFOX_CRASH_REPORT_ENABLED=false`, but it does not clearly state whether telemetry is enabled by default or what data may be transmitted. In a cloaked-browser skill intended for anti-detection workflows, undocumented outbound telemetry can expose sensitive browsing context, infrastructure details, or operational metadata to upstream services.

VirusTotal

64/64 vendors flagged this skill as clean.