camofox-on-replit
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Clones the
camofox-browserrepository fromhttps://github.com/jo-inc/camofox-browserto establish the server environment.\n- [EXTERNAL_DOWNLOADS]: Downloads the Camoufox browser engine (~1.3GB) vianpm run fetch-bin, which uses thecamoufox-jspackage to fetch binaries.\n- [COMMAND_EXECUTION]: The entry point scriptstart-camofox.shmanages the provisioning process, including creating a Python virtual environment and installing Node.js dependencies from the official NPM registry.\n- [COMMAND_EXECUTION]: Generates a transitive library closure for the Nix store and updatesLD_LIBRARY_PATHto ensure the Firefox-based engine can find its required GTK and X11 dependencies.\n- [COMMAND_EXECUTION]: Executesnode server.jsto launch the scraping server on the local host.\n- [INDIRECT_PROMPT_INJECTION]: The skill facilitates browsing external websites, which creates a surface for indirect prompt injection if the agent processes untrusted content returned by the scraper.\n - Ingestion points: Data entering the agent context via the
/tabsendpoint of the browser server (e.g., scraped HTML or text fromhttps://duckduckgo.com/).\n - Boundary markers: The skill documentation and scripts do not implement specific boundary markers or instructions to isolate external data.\n
- Capability inventory: The skill possesses network access and file system write access within its local state directory (
$CAMOFOX_ROOT/state).\n - Sanitization: No content sanitization or filtering logic is present in the provided skill files.
Audit Metadata