stealthy-auto-browse

ISSUES FOUND max severity CRITICALSkillSpector Caution 22 registry clawhub.ai last scanned 1 scan

5 findings (1 critical, 2 high, 2 medium), mainly data exfiltration, social engineering, resource abuse. Most recent scan 2026-02-07.

CRITICAL SECURITY RISK - This skill presents multiple severe security vulnerabilities. The primary threat is an uncontrolled external network dependency that sends arbitrary browsing commands and potentially sensitive data (including credentials typed via OS-level keyboard input) to a Docker container endpoint. The skill's explicit purpose is to evade bot detection and security controls, which is inherently deceptive and enables malicious use cases. The combination of external network communication, credential exposure via unencrypted keyboard input, lack of resource controls, and missing security metadata creates a high-risk attack surface. The skill should not be used in production environments without significant security hardening including localhost-only enforcement, encryption, authentication, and explicit user consent for sensitive operations.

Scanner's overall assessment (LLM analyzer)
Findings5
Critical1
High2
Medium2
Low0
Analyzersstatic llm meta

Second scanner: NVIDIA SkillSpector

VerdictCaution 22
Score22 / 100
Issues3
CategoriesMCP Rug Pull Memory Poisoning Data Exfiltration
Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Control a stealthy browser that evades bot detection using OS-level input

Package
1 file, 8.1 KB
SKILL.md
994 words, 12+ sections
Code
None. Instructions only.
Homepage
https://github.com/psyb0t/docker-stealthy-auto-browse

SKILL.md covers: stealthy-auto-browse · Setup Required · Key Concepts · Environment · API Reference · Navigation · Undetectable Input (Use These!) · Playwright Input (Detectable - Use Only When Necessary) · Page Inspection · Screenshots · State & Utility · Resolution Control

Findings

CRITICAL Uncontrolled External Network Dependency with Arbitrary Command Execution Data Exfiltrationllm

The skill requires connection to an external Docker container (stealthy-auto-browse) via STEALTHY_AUTO_BROWSE_URL environment variable. This container provides a headless browser with OS-level input control capabilities. The skill sends arbitrary commands to this external service without validation, creating a critical data exfiltration and command execution vector. An attacker controlling the container endpoint could intercept all browsing activity, credentials entered via system_type, and potentially execute arbitrary commands on the user's system through the browser automation API.

SKILL.md

Environment variable STEALTHY_AUTO_BROWSE_URL points to external service (http://localhost:8080 by default, but configurable to any URL). All API commands are POST requests to this endpoint with JSON payloads containing user data and browsing instructions. The system_type action sends keystrokes (potentially including passwords) to the external service.
Remediation: 1. Implement strict validation that STEALTHY_AUTO_BROWSE_URL must be localhost-only (reject non-localhost URLs). 2. Add authentication/authorization between skill and container. 3. Implement TLS for communication even on localhost. 4. Add explicit user consent before sending sensitive data (passwords, credentials) to the browser service. 5. Provide clear security warnings about the risks of browser automation with OS-level input.
HIGH Deceptive Purpose: Bot Detection Evasion Tool Social Engineeringllm

The skill's explicit purpose is to evade bot detection systems using OS-level input manipulation and fingerprint spoofing. The description states it is 'completely undetectable by behavioral analysis' and designed to bypass security measures. This capability can be used for malicious purposes including: automated account creation, credential stuffing, scraping protected content, bypassing CAPTCHAs, and other activities that violate terms of service. The skill actively promotes deception and security evasion.

SKILL.md

Key phrases: 'evades bot detection', 'completely undetectable by behavioral analysis', 'Uses Camoufox (custom Firefox) with OS-level mouse/keyboard input', 'Generates consistent fingerprints via browserforge', 'Standard browser automation is detectable... This browser: Uses Firefox (no CDP exposure)'
Remediation: 1. Add explicit warnings about legal and ethical implications of bot detection evasion. 2. Implement usage restrictions and logging. 3. Require explicit user acknowledgment of terms of service compliance. 4. Consider whether this capability should be provided at all given its primary use case for circumventing security controls.
HIGH Credential Exposure via Unencrypted OS-Level Keyboard Input Data Exfiltrationllm

The system_type action sends keyboard input at the OS level to type text, including potentially sensitive data like passwords and credentials. This data is transmitted to the external browser service via HTTP POST requests. There is no indication of encryption, input sanitization, or special handling for sensitive data. Combined with the external network dependency, this creates a high-risk credential exposure vector.

SKILL.md

system_type action: {"action": "system_type", "text": "hello world", "interval": 0.08}. The 'text' parameter can contain any string including passwords. No encryption or sensitive data handling is mentioned. Communication protocol is HTTP POST to STEALTHY_AUTO_BROWSE_URL.
Remediation: 1. Implement end-to-end encryption for all data sent to the browser service. 2. Add explicit warnings before typing sensitive data. 3. Provide a secure input mode that masks/encrypts credentials. 4. Log all system_type operations for audit purposes. 5. Require user confirmation before sending potentially sensitive keystrokes.
MEDIUM Misleading Compatibility and Security Implications Social Engineeringllm

The skill manifest does not specify compatibility, allowed-tools, or license information, while requiring complex external dependencies (Docker container, VNC server, environment configuration). The description 'Control a stealthy browser that evades bot detection' downplays the security implications and potential for misuse. Users may not understand they are installing a tool designed to circumvent security controls.

SKILL.md

YAML manifest shows: license: Not specified, compatibility: Not specified, allowed-tools: Not specified. The setup requires Docker, port forwarding (8080, 5900), environment variable configuration, and external network access - none of which are declared in the manifest.
Remediation: 1. Add explicit compatibility field listing requirements (Docker, network access, VNC). 2. Specify allowed-tools to indicate network access requirements. 3. Add clear license information. 4. Include security warnings in the description about the tool's purpose and risks. 5. Document all external dependencies and their security implications.
MEDIUM Uncontrolled Resource Consumption via External Browser Resource Abusellm

The skill connects to an external Docker container running a full browser with VNC server. There are no documented limits on: number of browser instances, memory usage, CPU consumption, network bandwidth, or session duration. The 'always: True' flag in metadata suggests persistent execution. An attacker or buggy code could spawn unlimited browser instances or create long-running sessions that exhaust system resources.

SKILL.md

Docker container runs browser + VNC server on ports 8080 and 5900. Metadata shows 'always': True indicating persistent availability. No resource limits, timeouts, or cleanup procedures are documented. The goto action supports 'networkidle' wait condition which could hang indefinitely.
Remediation: 1. Implement session timeouts and automatic cleanup. 2. Add resource limits (max memory, CPU, network bandwidth). 3. Limit number of concurrent browser instances. 4. Add timeout parameters to all blocking operations. 5. Implement health checks and automatic container restart. 6. Document resource requirements and cleanup procedures.

What is in the package

FileKindSize
SKILL.mddoc8.1 KB

External hosts referenced

github.com

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Environment variables referenced

STEALTHY_AUTO_BROWSE_URL

Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

What we did not check

Sources

Related skills