Skills/PyPI/cloakbrowsermcp

cloakbrowsermcp@2.0.4

BLOCKED

Publisher claims: "Stealth browser MCP server — anti-detection Chromium + snapshot-first AI agent interface" Observed in sandbox: calls github.com only, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher overtimepog · joined 4 days agoInstalls 212Last detonated 4d ago
What would fix thisWatchDispute verdict

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-10-29 and scored it 34/100 (Blocked). Do not install it: the sandbox observed behaviour consistent with credential theft, exfiltration or persistence. Notable findings: Pipe-to-shell pattern; URL with embedded credentials; Direct script execution from GitHub raw URL. Summary: calls github.com only, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios
t+CategoryObserved action
0.2sfilesystemread ~/.netrc
0.2sfilesystemread ~/.cloakbrowsermcp/.git/config · ~/.cloakbrowsermcp/.git/packed-refs · ~/.cloakbrowsermcp/.git/HEAD · ~/.cloakbrowsermcp/.git · ~/.cloakbrowsermcp/.git/refs · ~/.cloakbrowsermcp/.git/refs/tags outside project
0.2sfilesystemwrote ~/.cloakbrowsermcp/.git/info/exclude · ~/.cloakbrowsermcp/.git/hooks/pre-receive.sample · ~/.cloakbrowsermcp/.git/hooks/commit-msg.sample · ~/.cloakbrowsermcp/.git/hooks/prepare-commit-msg.sample · ~/.cloakbrowsermcp/.git/hooks/push-to-checkout.sample · ~/.cloakbrowsermcp/.git/hooks/update.sample
0.2snetworkCONNECT https://github.com
0.2sprocessexec /usr/bin/python3.11
0.2sprocessexec /usr/bin/git
0.2sprocessexec /usr/lib/git-core/git
0.2sprocessexec /usr/lib/git-core/git-remote-https
0.2sprocessexited 128: fatal: unable to access 'https://github.com/overtimepog/CloakMCP.git/': CONNECT tunnel failed, response 403
0.3sprocessdependency install exit 1
0.3sprocessexec /usr/bin/timeout
0.3sprocessexec .venv/bin/cloakbrowsermcp
0.3sprocessexited 127: timeout: failed to run command '.venv/bin/cloakbrowsermcp': No such file or directory
0.3sclaimedno tools/list reply (exit 127)
0.3sprocessscript backend runs setup only

Static findings

MEDIUM
URL with embedded credentialstests/test_session.py:141 · URL with embedded credentials — may be phishing or credential leakingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
URL with embedded credentialstests/test_session.py:37 · URL with embedded credentials — may be phishing or credential leakingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
CRITICAL
Pipe-to-shell patternsetup.sh:5 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
URL with embedded credentialscloakbrowsermcp/server.py:366 · URL with embedded credentials — may be phishing or credential leakingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Python subprocess execution detectedcloakbrowsermcp/session.py:69 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Direct script execution from GitHub raw URLsetup.sh:5 · Direct script execution from GitHub raw URL — unverified code sourceFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Privileged sudo commandsetup.sh:97 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
URL with embedded credentialstests/test_session.py:132 · URL with embedded credentials — may be phishing or credential leakingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Python subprocess execution detectedcloakbrowsermcp/session.py:58 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Remote installer piped to shellsetup.sh:5 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
File permission modification commandsetup.sh:118 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
URL with embedded credentialstests/test_session.py:28 · URL with embedded credentials — may be phishing or credential leakingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07

What would make this Verified

46 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Reads credential files≈ +27 on the totalThe sandbox saw reads under ~/.ssh, ~/.aws, ~/.npmrc, ~/.config or similar. Read only files inside the project, and only the ones the task needs.
  2. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  3. Unclaimed publisher≈ +8 on the totalClaim overtimepog: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  4. Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
  5. Direct script execution from GitHub raw URL≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  6. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim overtimepog