Skill Trust Decision
chrome-use
Skill contains documented curl|bash remote script execution patterns that bypass any local audit and execute arbitrary code from remote GitHub repositories without integrity verification.
Most direct threat evidence
Critical RCE
Remote Script Download and Execution via curl|bash The install command `curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh` downloads a script from a remote GitHub raw URL and executes it without integrity verification. This allows arbitrary code execution controlled by the repository owner.
SKILL.md:36 Why this conclusion was reached
3/4 dimensions flagged Block
Declared vs actual capability
3 undeclared or violating capabilities were inferred.
Block
Hidden execution and egress
2 high-risk artifacts or egress signals were extracted.
Block
Attack chain and severe findings
The report includes 5 attack-chain steps and 3 severe findings.
Pass
Dependencies and supply chain hygiene
Dependencies are present but no obvious high-risk issue stands out.
Attack Chain
01
Skill presents as legitimate browser automation tool via SKILL.md
Entry · SKILL.md:1
02
User or agent executes install command containing curl|bash pattern
initialization · SKILL.md:36
03
Remote script downloaded and piped directly to sh, executing arbitrary code with user privileges
Execution · SKILL.md:36
04
Binary installed to system PATH, upgrade mechanism registered
Persistence · install.sh (remote):N/A
05
Cross-repo upgrade script from leeguooooo/plugins introduces additional attack surface
supply_chain · SKILL.md:58
What drove the risk score up
curl|bash remote execution +30
install.sh fetched from raw.githubusercontent.com and executed directly via pipe to sh
Undeclared shell:WRITE capability +20
allowed-tools only declares Bash(chrome-use:*), but SKILL.md instructs curl|bash which executes arbitrary remote code
Third-party family upgrade +15
upgrade-use-family.sh from plugins repo executes scripts across repos without verification
Most important evidence
Critical RCE
Remote Script Download and Execution via curl|bash
The install command `curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh` downloads a script from a remote GitHub raw URL and executes it without integrity verification. This allows arbitrary code execution controlled by the repository owner.
SKILL.md:36 Download script, review contents, then execute locally. Pin to specific version/commit rather than latest.
Critical Supply Chain
Cross-Repository Upgrade Script Execution
The family upgrade command downloads and executes scripts from `leeguooooo/plugins` repository, introducing a third-party supply chain dependency not declared in allowed-tools.
SKILL.md:58 Isolate upgrade scope to the current skill only. Verify third-party script integrity before execution.
High Doc Mismatch
Capability Mismatch: Declared vs Inferred
allowed-tools declares `Bash(chrome-use:*)` implying controlled CLI execution, but the skill instructs full bash shell access with pipe-to-sh patterns that bypass any CLI wrapper.
SKILL.md:1 Restrict allowed-tools to specific subcommands; document all shell patterns explicitly in SKILL.md.
Medium Supply Chain
Unversioned Remote Script Sources
Both install.sh and upgrade scripts are fetched from 'main' branch URLs without version pinning, allowing content changes without skill version bumps.
SKILL.md:36 Pin to tagged releases or commit SHAs. Host verified scripts on trusted infrastructure.
Declared capability vs actual capability
Shell Block
Declared WRITE (chrome-use:*)
→ Inferred WRITE (full remote exec)
SKILL.md:36 — curl -fsSL | sh Network Block
Declared READ (web browsing)
→ Inferred WRITE (remote download+exec)
SKILL.md:36,58 — fetch and execute remote scripts Filesystem Block
Declared NONE
→ Inferred WRITE (binary install)
install.sh writes chrome-use binary to system PATH Suspicious artifacts and egress
Critical Dangerous Command
curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh SKILL.md:36
Critical Dangerous Command
curl -fsSL https://raw.githubusercontent.com/leeguooooo/plugins/main/upgrade-use-family.sh | sh SKILL.md:58
Medium External URL
https://clawhub.ai/user/leeguooooo skill-card.md:9
Medium External URL
https://clawhub.ai/leeguooooo/skills/chrome-use skill-card.md:35
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| chrome-use | latest (unpinned) | GitHub releases | No | Binary downloaded at runtime from raw.githubusercontent.com without integrity hash verification |
| install.sh | main branch | GitHub raw | No | Script fetched and executed directly without review |
| upgrade-use-family.sh | main branch | GitHub raw (plugins repo) | No | Third-party script cross-repo dependency |
File composition
3 files · 116 lines
Markdown 2 files · 111 linesJSON 1 files · 5 lines
Files of concern · 2
SKILL.md Remote Script Download and Execution via curl|bash · Cross-Repository Upgrade Script Execution · Capability Mismatch: Declared vs Inferred · Unversioned Remote Script Sources · curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh · curl -fsSL https://raw.githubusercontent.com/leeguooooo/plugins/main/upgrade-use-family.sh | sh
skill-card.md https://clawhub.ai/user/leeguooooo · https://clawhub.ai/leeguooooo/skills/chrome-use
Other files · _meta.json
Security positives
skill-card.md explicitly documents the remote script execution risk and advises users to verify sources before running
CLI upgrade supports --check mode to inspect updates without executing
No evidence of credential harvesting or data exfiltration in documented behavior