Why this verdict
- suspicious: finding mcp-server:.:src/index.ts:644:HIJACK
Security findings 1
Agent hijacking
mediumContextual risklow confidenceThe getting-started prompt tells the agent that no human approval is needed while it registers, funds a crypto wallet and hires humans, discouraging user confirmation for financially consequential actions.
No human approval needed.
vector:instruction
Counter-argument considered
The prompt text tells the agent that no human approval is needed while the same flow has it register, fund a crypto wallet and hire people. That discourages user confirmation for financial actions, and no mitigation or declaration covers it.
Refuted findings 3
Candidates the review stage examined and rejected, kept for transparency.
Manipulation
highRefutedlow confidenceThe pre-warm prompt coaches the agent to mimic human behavior and use a real person's browser fingerprint to bypass CAPTCHA and bot-detection when registering accounts on third-party sites.
Behave like a human: pause, scroll a bit before clicking submit, do not paste large blobs instantly.
Why it was refuted
The prompt is a declared tool whose stated description is renting a browser to register on sites that block clean sessions. Human-like pacing advice is the declared core capability of the product, not a concealed or contradictory behavior.
Manipulation
mediumRefutedlow confidenceThe example documents using rented real-human residential browsers to bypass captcha and bot defenses and register accounts on a third-party site, which facilitates automated signup abuse and evasion of anti-bot controls.
captcha passes naturally because fingerprint + IP look human
Why it was refuted
The captcha-protected signup flow is the openly declared, advertised purpose of the real-browser rental product, and the pre-warm prompt is a declared tool. It is a declared core capability, not a concealed behavior or an instruction to subvert the user.
Manipulation
mediumRefutedlow confidenceA bundled prompt coaches the agent to defeat CAPTCHA and bot-detection gates on third-party sites (e.g. Reddit) by using a rented human fingerprint and mimicking human behavior, which is detection evasion and could facilitate bulk account registration, though it is in line with the declared browser-rental purpose.
The whole point of real-Chrome rental is that you do not need to fight bot detection.
Why it was refuted
The line explains the product's value proposition: a rented real human's Chrome. The prompt's declared description openly states the purpose, so this is a declared core capability, and the finding itself concedes it matches the declared browser-rental purpose.
Coverage gaps 1
Parts of the artifact the static analysis could not fully examine.
context:manifest_unparseable yaml: while scanning a simple key
.github/workflows/submit-ceki.yml
