camofox-on-replit

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Clones the camofox-browser repository from https://github.com/jo-inc/camofox-browser to establish the server environment.\n- [EXTERNAL_DOWNLOADS]: Downloads the Camoufox browser engine (~1.3GB) via npm run fetch-bin, which uses the camoufox-js package to fetch binaries.\n- [COMMAND_EXECUTION]: The entry point script start-camofox.sh manages the provisioning process, including creating a Python virtual environment and installing Node.js dependencies from the official NPM registry.\n- [COMMAND_EXECUTION]: Generates a transitive library closure for the Nix store and updates LD_LIBRARY_PATH to ensure the Firefox-based engine can find its required GTK and X11 dependencies.\n- [COMMAND_EXECUTION]: Executes node server.js to launch the scraping server on the local host.\n- [INDIRECT_PROMPT_INJECTION]: The skill facilitates browsing external websites, which creates a surface for indirect prompt injection if the agent processes untrusted content returned by the scraper.\n
  • Ingestion points: Data entering the agent context via the /tabs endpoint of the browser server (e.g., scraped HTML or text from https://duckduckgo.com/).\n
  • Boundary markers: The skill documentation and scripts do not implement specific boundary markers or instructions to isolate external data.\n
  • Capability inventory: The skill possesses network access and file system write access within its local state directory ($CAMOFOX_ROOT/state).\n
  • Sanitization: No content sanitization or filtering logic is present in the provided skill files.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 02:47 AM
Security Audit — agent-trust-hub — camofox-on-replit