camofox-cloaked-browser
Warn
Audited by Gen Agent Trust Hub on Jul 5, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download the @askjo/camofox-browser package from the npm registry and clone the camofox-browser repository from GitHub (github.com/jo-inc/camofox-browser).
- [REMOTE_CODE_EXECUTION]: Instructs the agent to execute code from external sources via npx -y, npm install, and openclaw plugins install. The package also triggers a download of the Camoufox browser binary during its post-install phase.
- [COMMAND_EXECUTION]: Uses various shell commands for its core functionality, including curl for interacting with the REST API, npx for server execution, and python3 -c for processing API response data.
- [DATA_EXFILTRATION]: Includes telemetry features that send anonymized crash and hang reports to an external endpoint (CAMOFOX_CRASH_REPORT_URL). The skill provides instructions on how to disable this via the CAMOFOX_CRASH_REPORT_ENABLED environment variable.
- [PROMPT_INJECTION]: Presents an attack surface for indirect prompt injection when processing data from the browser server.
- Ingestion points: Browser snapshots (camofox_snapshot) and structured extractions (camofox_extract) from external websites.
- Boundary markers: No specific delimiters or safety instructions are provided to the agent to distinguish between its instructions and content retrieved from the web.
- Capability inventory: The skill allows arbitrary JavaScript execution (camofox_evaluate), shell command execution, and network access.
- Sanitization: No input validation or sanitization is performed on the data fetched from external sites.
Audit Metadata