agent-browser-with-camoufox

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The set includes running remote install scripts (astral.sh, sh.rustup.rs) and installing/running binaries from small or low-reputation GitHub repos (daijro/camoufox, browser-use/agent-browser) and instructions to replace system binaries—actions that can execute unreviewed code and are therefore moderately to highly risky.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's required install script and SKILL.md explicitly fetch and clone public third-party resources (e.g., git clone https://github.com/browser-use/agent-browser.git, npm install -g agent-browser, uv/pip install camoufox and using camoufox.sync_api to download browser binaries) and then read/modify files such as src/browser.ts or dist/browser.js as part of its workflow, so untrusted external content can be ingested and materially influence code changes and runtime actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The install script fetches and executes remote installer scripts at runtime (e.g., curl -LsSf https://astral.sh/uv/install.sh | sh and curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh) and also clones/installs remote code (git clone https://github.com/browser-use/agent-browser.git, uv pip install camoufox) so these URLs are runtime dependencies that execute fetched code and are therefore potentially risky.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill instructs installing and replacing globally‑installed software (npm -g, uv pip --system, copying into $(npm root -g)/agent-browser and running curl|sh), actions that modify system-wide binaries and likely require elevated privileges and thus can compromise the machine state.