Skill Trust Decision
chrome-use
The skill executes undeclared remote shell script installation via curl|sh, a critical unsafe pattern that bypasses the declared allowed-tools scope and could install arbitrary code.
Most direct threat evidence
Critical RCE
Undeclared remote shell script execution The install command 'curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh' is executed via Bash but is NOT listed in allowed-tools. The allowed-tools only permit 'chrome-use:*', 'abs:*', and 'npx chrome-use:*' — not arbitrary curl|sh. This is a clear doc-to-code mismatch where hidden functionality bypasses the declared permission scope.
SKILL.md:29 Why this conclusion was reached
3/4 dimensions flagged Block
Declared vs actual capability
1 undeclared or violating capabilities were inferred.
Block
Hidden execution and egress
1 high-risk artifacts or egress signals were extracted.
Block
Attack chain and severe findings
The report includes 4 attack-chain steps and 1 severe findings.
Pass
Dependencies and supply chain hygiene
Dependencies are present but no obvious high-risk issue stands out.
Attack Chain
01
User requests a browser automation task via the chrome-use skill
Entry · SKILL.md:1
02
Skill detects missing chrome-use binary and triggers install via undeclared curl|sh command
Escalation · SKILL.md:29
03
Remote script from GitHub raw URL is downloaded and piped directly to sh with shell:WRITE privileges
Escalation · SKILL.md:29
04
Arbitrary code executes on the user's system — potential for backdoor installation, binary swap, or credential theft
Impact · install.sh (remote, unauditable):N/A
What drove the risk score up
Undeclared remote script execution via curl|sh +40
SKILL.md line 29 executes 'curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh' which is NOT covered by allowed-tools (chrome-use:*, abs:*, npx chrome-use:*)
Remote script execution pattern (curl|bash/wget|sh) +20
High-risk indicator: downloading and piping remote script directly to shell — script content can change at any time
No integrity verification +5
No GPG signature, SHA256 hash, or pinned version for the downloaded script
Most important evidence
Critical RCE
Undeclared remote shell script execution
The install command 'curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh' is executed via Bash but is NOT listed in allowed-tools. The allowed-tools only permit 'chrome-use:*', 'abs:*', and 'npx chrome-use:*' — not arbitrary curl|sh. This is a clear doc-to-code mismatch where hidden functionality bypasses the declared permission scope.
SKILL.md:29 Remove the curl|sh pattern. Replace with a pinned binary download (e.g., pinned tar.gz with SHA256 verification) or a package manager install (brew/apt). The install script content must be auditable and version-pinned.
Medium Supply Chain
Remote script from mutable source with no integrity check
The install script is fetched from a raw GitHub URL which can be updated at any time by the repository owner. There is no GPG signature, SHA256 hash, or version pin to verify the script's integrity. An attacker who compromises the repo or a MITM could modify the script to install malicious code.
SKILL.md:29 Pin the script to a specific commit SHA or tag, and include a SHA256 verification step before execution.
Medium Doc Mismatch
Allowed-tools scope misrepresents actual shell behavior
The allowed-tools declaration creates the impression that shell access is restricted to the chrome-use CLI tool. In practice, the skill executes an unrestricted remote script that can install any binary, modify system files, and execute arbitrary commands. This hidden breadth of capability is not reflected in the declared permissions.
SKILL.md:1 Update allowed-tools to accurately reflect that remote script execution is permitted, or restructure the install to use only the declared tools.
Declared capability vs actual capability
Shell Block
Declared WRITE (chrome-use:*, abs:*, npx chrome-use:*)
→ Inferred WRITE (arbitrary remote script execution via curl|sh)
SKILL.md:29 — install command not in allowed-tools scope Suspicious artifacts and egress
Critical Dangerous Command
curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh SKILL.md:29
Medium External URL
https://dashboard.chrome-use.localhost SKILL.md:85
Medium External URL
https://clawhub.ai/user/leeguooooo skill-card.md:9
Medium External URL
https://clawhub.ai/leeguooooo/skills/chrome-use skill-card.md:35
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| install.sh (remote script) | main branch, unpinned | https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | No | No integrity verification — script content mutable and fetched over HTTPS without hash verification |
File composition
3 files · 143 lines
Markdown 2 files · 138 linesJSON 1 files · 5 lines
Files of concern · 2
SKILL.md Undeclared remote shell script execution · Remote script from mutable source with no integrity check · Allowed-tools scope misrepresents actual shell behavior · curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh · https://dashboard.chrome-use.localhost
skill-card.md https://clawhub.ai/user/leeguooooo · https://clawhub.ai/leeguooooo/skills/chrome-use
Other files · _meta.json
Security positives
MIT-0 license with clear attribution and publisher profile on ClawHub
skill-card.md explicitly warns against auto-running the remote installer — acknowledging the risk
The core chrome-use functionality (browser automation via CDP) is a legitimate and well-scoped use case
No evidence of credential harvesting or data exfiltration in the examined files
No obfuscation techniques (base64, eval) detected