安全决策报告
chrome-use
Skill contains documented curl|bash remote script execution patterns that bypass any local audit and execute arbitrary code from remote GitHub repositories without integrity verification.
最直接的威胁证据
严重 代码执行
Remote Script Download and Execution via curl|bash The install command `curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh` downloads a script from a remote GitHub raw URL and executes it without integrity verification. This allows arbitrary code execution controlled by the repository owner.
SKILL.md:36 为什么得出这个结论
3/4 个维度触发 阻止
声明与实际能力
发现 3 项声明之外的能力或越权行为。
阻止
隐藏执行与外联
提取到 2 个高危 IOC 或外联信号。
阻止
攻击链与高危发现
报告包含 5 步攻击链，另有 3 项高危或严重发现。
通过
依赖与供应链卫生
依赖结构存在，但暂未看到明显高危告警。
攻击链
01
Skill presents as legitimate browser automation tool via SKILL.md
初始入口 · SKILL.md:1
02
User or agent executes install command containing curl|bash pattern
initialization · SKILL.md:36
03
Remote script downloaded and piped directly to sh, executing arbitrary code with user privileges
代码执行 · SKILL.md:36
04
Binary installed to system PATH, upgrade mechanism registered
持久化 · install.sh (remote):N/A
05
Cross-repo upgrade script from leeguooooo/plugins introduces additional attack surface
supply_chain · SKILL.md:58
风险分是怎么被拉高的
curl|bash remote execution +30
install.sh fetched from raw.githubusercontent.com and executed directly via pipe to sh
Undeclared shell:WRITE capability +20
allowed-tools only declares Bash(chrome-use:*), but SKILL.md instructs curl|bash which executes arbitrary remote code
Third-party family upgrade +15
upgrade-use-family.sh from plugins repo executes scripts across repos without verification
最关键的证据
严重 代码执行
Remote Script Download and Execution via curl|bash
The install command `curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh` downloads a script from a remote GitHub raw URL and executes it without integrity verification. This allows arbitrary code execution controlled by the repository owner.
SKILL.md:36 Download script, review contents, then execute locally. Pin to specific version/commit rather than latest.
严重 供应链
Cross-Repository Upgrade Script Execution
The family upgrade command downloads and executes scripts from `leeguooooo/plugins` repository, introducing a third-party supply chain dependency not declared in allowed-tools.
SKILL.md:58 Isolate upgrade scope to the current skill only. Verify third-party script integrity before execution.
高危 文档欺骗
Capability Mismatch: Declared vs Inferred
allowed-tools declares `Bash(chrome-use:*)` implying controlled CLI execution, but the skill instructs full bash shell access with pipe-to-sh patterns that bypass any CLI wrapper.
SKILL.md:1 Restrict allowed-tools to specific subcommands; document all shell patterns explicitly in SKILL.md.
中危 供应链
Unversioned Remote Script Sources
Both install.sh and upgrade scripts are fetched from 'main' branch URLs without version pinning, allowing content changes without skill version bumps.
SKILL.md:36 Pin to tagged releases or commit SHAs. Host verified scripts on trusted infrastructure.
声明能力 vs 实际能力
命令执行 阻止
声明 WRITE (chrome-use:*)
→ 推断 WRITE (full remote exec)
SKILL.md:36 — curl -fsSL | sh 网络访问 阻止
声明 READ (web browsing)
→ 推断 WRITE (remote download+exec)
SKILL.md:36,58 — fetch and execute remote scripts 文件系统 阻止
声明 NONE
→ 推断 WRITE (binary install)
install.sh writes chrome-use binary to system PATH 可疑产物与外联
严重 危险命令
curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh SKILL.md:36
严重 危险命令
curl -fsSL https://raw.githubusercontent.com/leeguooooo/plugins/main/upgrade-use-family.sh | sh SKILL.md:58
中危 外部 URL
https://clawhub.ai/user/leeguooooo skill-card.md:9
中危 外部 URL
https://clawhub.ai/leeguooooo/skills/chrome-use skill-card.md:35
依赖与供应链
| 包名 | 版本 | 来源 | 漏洞 | 备注 |
|---|---|---|---|---|
| chrome-use | latest (unpinned) | GitHub releases | 否 | Binary downloaded at runtime from raw.githubusercontent.com without integrity hash verification |
| install.sh | main branch | GitHub raw | 否 | Script fetched and executed directly without review |
| upgrade-use-family.sh | main branch | GitHub raw (plugins repo) | 否 | Third-party script cross-repo dependency |
文件构成
3 个文件 · 116 行
Markdown 2 个文件 · 111 行JSON 1 个文件 · 5 行
需关注文件 · 2
SKILL.md Remote Script Download and Execution via curl|bash · Cross-Repository Upgrade Script Execution · Capability Mismatch: Declared vs Inferred · Unversioned Remote Script Sources · curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh · curl -fsSL https://raw.githubusercontent.com/leeguooooo/plugins/main/upgrade-use-family.sh | sh
skill-card.md https://clawhub.ai/user/leeguooooo · https://clawhub.ai/leeguooooo/skills/chrome-use
其他文件 · _meta.json
安全亮点
skill-card.md explicitly documents the remote script execution risk and advises users to verify sources before running
CLI upgrade supports --check mode to inspect updates without executing
No evidence of credential harvesting or data exfiltration in documented behavior