The Agent Skills Directory

[COMMAND_EXECUTION]: The skill documents the use of npx and npm for installing and managing the camoufox-mcp-server. These are standard development workflows for Node.js-based MCP servers and are used here for lifecycle management (fetching binaries, running diagnostics).
[EXTERNAL_DOWNLOADS]: The skill downloads the Camoufox browser binary (approx. 780MB) using npx -y camoufox-js fetch. This is a well-known browser automation project, and the download is a functional requirement for the skill's operation.
[REMOTE_CODE_EXECUTION]: The skill provides an evaluate action which allows running arbitrary JavaScript in the browser context. However, this feature is explicitly disabled by default and requires an operator to set a specific environment variable (CAMOUFOX_MCP_ALLOW_EVALUATE=1). The instructions correctly guide the agent to check the evaluateAllowed status before attempting to use it.
[DATA_EXFILTRATION]: While the skill is designed to navigate the web, it includes best-effort SSRF protection policies and encourages 'narrow' tool usage (like browse_find or browse_links) to minimize the amount of data pulled into the LLM context. No hardcoded credentials or sensitive file access patterns were found.
[SAFE]: The skill follows security best practices for MCP servers by defaulting to a safe configuration and requiring explicit environment variables for 'unsafe' browser features (such as modifying Firefox preferences or running custom scripts). The npm run doctor command provides a transparent way for users to verify the integrity of the local installation.

camoufox