Camofox Cloaked Browser

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:09 AM UTC
• Version: 1.3.4

Overview

The skill is coherent and disclosed, but it asks users to run an unpinned npm browser package that downloads a large executable at install time.

Install only if you trust the npm package publisher and are comfortable running a cloaked browser service locally. Prefer pinning `@askjo/camofox-browser` to a reviewed version, using a verified Camoufox binary via `CAMOUFOX_EXECUTABLE`, disabling crash telemetry when privacy matters, keeping the server on loopback, and setting access keys before any non-local exposure.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:116

Finding

Unpinned Third-Party Package Execution with Postinstall Binary Download

Content

View full analysis

Remediation

View remediation

``` 2. Document the expected npm integrity digest and require verification against a trusted release manifest before execution. 3. Replace the mutable Git clone workflow with a pinned, reviewed commit or signed tag: ```bash git clone https://github.com/jo-inc/camofox-browser cd camofox-browser git checkout --detach ``` 4. Use a committed lockfile and a deterministic installation command such as `npm ci` rather than an unconstrained `npm install`. 5. Verify the downloaded Camoufox browser artifact using a published cryptographic checksum or signature before installation or execution. 6. Prefer `CAMOFOX_SKIP_DOWNLOAD=true` together with `CAMOUFOX_EXECUTABLE` pointing to a separately obtained and verified browser bundle when practical. 7. Run installation and browser startup as an unprivileged, dedicated user in a sandbox or container with restricted filesystem and network access. Do not run the installation with `sudo` or as root. 8. Disable telemetry for privacy-conservative deployments unless explicitly required: ```bash CAMOFOX_CRASH_REPORT_ENABLED=false ``` 9. If the server is reachable beyond loopback, require `CAMOFOX_ACCESS_KEY`, use TLS through a trusted reverse proxy, and restrict inbound access at the network layer. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

through Camofox.

Default target

Default local server:

text

http://127.0.0.1:9377

Equivalent localhost URL is usually fine:

text

http://localhost:9377

Prefer 127.0.0.1 in examples to avoid IPv6/localhost oddities.

There is no container target in this skill. Do not mention or rely on container names; this skill is about the npm server and OpenClaw plugin/API.

Operating model

Camofox Browser is a Node server and OpenClaw plugin wrapper around Camoufox, a Firefox-based anti-detection browser.

Primary local startup:

bash

npx -y @askjo/camofox-browser
# serves http://127.0.0.1:9377 by default

Alternative cloned-repo startup:

bash

git clone https://github.com/jo-inc/camofox-browser
cd camofox-browser
npm install
npm start

Alternative global install:

bash

npm install -g @askjo/camofox-browser
camofox-browser

npm install / npx downloads the Camoufox browser binary on first run via the package postinstall unless CAMOUFOX_EXECUTABLE

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The README instructs users to execute npx skills without pinning a specific package version, which means the fetched code can change over time and may execute an unexpected or compromised release at install time. Because npx downloads and runs code directly, a supply-chain compromise or malicious republish could lead to arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This is another instance of the same issue: npx skills is invoked without a pinned version, so users are instructed to run whatever package version is current at execution time. That creates a supply-chain risk window where a compromised upstream package or dependency could execute arbitrary code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The command npx -y @askjo/camofox-browser runs an unpinned package directly from the registry, giving that package immediate code execution on the host. In this skill's context, that package starts a cloaked browser service and may handle browsing, credentials, and traffic routing, so a compromised release could have significant host and privacy impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The README notes that crash/hang telemetry exists and mentions an environment variable to disable it, but it does not clearly warn users that browser activity or diagnostics may be sent upstream by default. Given this skill is specifically for anti-detection browsing, the privacy mismatch is more serious because users may expect stealth while unaware of telemetry leaving the system.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

MCP server references in the skill manifest without version pinning are a rug-pull risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md

tools, REST API commands, session/tab workflow, environment variables,
  process-scoped CAMOFOX_URL for Hermes, and hard rules such as always sending
  userId and re-snapshotting after state-changing actions. Do not use for normal
  web search, text extraction, curl fetches, or ordinary browser automation.
version: 1.3.4
author: Trevin Chow
license: MIT-0

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The skill instructs users to start a remote npm package via npx -y @askjo/camofox-browser without pinning an exact version. That allows execution of whatever package version is current at invocation time, creating supply-chain risk if the package is compromised, a malicious version is published, or dependencies/postinstall scripts are abused.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 246)May include surrounding context.

Navigate

bash

curl -fsS -X POST "$BASE/tabs/$TAB_ID/navigate" \
  -H 'Content-Type: application/json' \
  "${AUTH_HEADER[@]}" \
  -d "{\"userId\":\"$USER_ID\",\"url\":\"https://example.com\"}"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 482)May include surrounding context.

md

Hard rules for Hermes:

- **Do not** add `CAMOFOX_URL` to `~/.hermes/.env`.
- **Do not** export `CAMOFOX_URL` in shell profiles such as `~/.zshrc`, `~/.bashrc`, launchd plists, Docker env, or service env.
- **Do not** put `CAMOFOX_URL` in the Hermes gateway environment unless the explicit intent is for the entire gateway process to use Camofox for browser calls.
- **Do not** use `hermes config set ... CAMOFOX_URL ...`; this is runtime state, not durable config.
- Use `CAMOFOX_URL` only as an inline, one-process env var for a dedicated cloaked Hermes run:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 513)May include surrounding context.

openclaw camofox status

text

3. Raw REST mode: create a tab, snapshot it, close it.

4. Hermes mode: verify `CAMOFOX_URL` is absent from global Hermes env and present only on the dedicated cloaked Hermes process, if Hermes process routing is intentionally being used.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 15% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md

tools, REST API commands, session/tab workflow, environment variables,
  process-scoped CAMOFOX_URL for Hermes, and hard rules such as always sending
  userId and re-snapshotting after state-changing actions. Do not use for normal
  web search, text extraction, curl fetches, or ordinary browser automation.
version: 1.3.4
author: Trevin Chow
license: MIT-0

Static analysis

No suspicious patterns detected.