安全决策报告
chrome-use
The skill executes undeclared remote shell script installation via curl|sh, a critical unsafe pattern that bypasses the declared allowed-tools scope and could install arbitrary code.
最直接的威胁证据
严重 代码执行
Undeclared remote shell script execution The install command 'curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh' is executed via Bash but is NOT listed in allowed-tools. The allowed-tools only permit 'chrome-use:*', 'abs:*', and 'npx chrome-use:*' — not arbitrary curl|sh. This is a clear doc-to-code mismatch where hidden functionality bypasses the declared permission scope.
SKILL.md:29 为什么得出这个结论
3/4 个维度触发 阻止
声明与实际能力
发现 1 项声明之外的能力或越权行为。
阻止
隐藏执行与外联
提取到 1 个高危 IOC 或外联信号。
阻止
攻击链与高危发现
报告包含 4 步攻击链，另有 1 项高危或严重发现。
通过
依赖与供应链卫生
依赖结构存在，但暂未看到明显高危告警。
攻击链
01
User requests a browser automation task via the chrome-use skill
初始入口 · SKILL.md:1
02
Skill detects missing chrome-use binary and triggers install via undeclared curl|sh command
权限提升 · SKILL.md:29
03
Remote script from GitHub raw URL is downloaded and piped directly to sh with shell:WRITE privileges
权限提升 · SKILL.md:29
04
Arbitrary code executes on the user's system — potential for backdoor installation, binary swap, or credential theft
最终危害 · install.sh (remote, unauditable):N/A
风险分是怎么被拉高的
Undeclared remote script execution via curl|sh +40
SKILL.md line 29 executes 'curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh' which is NOT covered by allowed-tools (chrome-use:*, abs:*, npx chrome-use:*)
Remote script execution pattern (curl|bash/wget|sh) +20
High-risk indicator: downloading and piping remote script directly to shell — script content can change at any time
No integrity verification +5
No GPG signature, SHA256 hash, or pinned version for the downloaded script
最关键的证据
严重 代码执行
Undeclared remote shell script execution
The install command 'curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh' is executed via Bash but is NOT listed in allowed-tools. The allowed-tools only permit 'chrome-use:*', 'abs:*', and 'npx chrome-use:*' — not arbitrary curl|sh. This is a clear doc-to-code mismatch where hidden functionality bypasses the declared permission scope.
SKILL.md:29 Remove the curl|sh pattern. Replace with a pinned binary download (e.g., pinned tar.gz with SHA256 verification) or a package manager install (brew/apt). The install script content must be auditable and version-pinned.
中危 供应链
Remote script from mutable source with no integrity check
The install script is fetched from a raw GitHub URL which can be updated at any time by the repository owner. There is no GPG signature, SHA256 hash, or version pin to verify the script's integrity. An attacker who compromises the repo or a MITM could modify the script to install malicious code.
SKILL.md:29 Pin the script to a specific commit SHA or tag, and include a SHA256 verification step before execution.
中危 文档欺骗
Allowed-tools scope misrepresents actual shell behavior
The allowed-tools declaration creates the impression that shell access is restricted to the chrome-use CLI tool. In practice, the skill executes an unrestricted remote script that can install any binary, modify system files, and execute arbitrary commands. This hidden breadth of capability is not reflected in the declared permissions.
SKILL.md:1 Update allowed-tools to accurately reflect that remote script execution is permitted, or restructure the install to use only the declared tools.
声明能力 vs 实际能力
命令执行 阻止
声明 WRITE (chrome-use:*, abs:*, npx chrome-use:*)
→ 推断 WRITE (arbitrary remote script execution via curl|sh)
SKILL.md:29 — install command not in allowed-tools scope 可疑产物与外联
严重 危险命令
curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh SKILL.md:29
中危 外部 URL
https://dashboard.chrome-use.localhost SKILL.md:85
中危 外部 URL
https://clawhub.ai/user/leeguooooo skill-card.md:9
中危 外部 URL
https://clawhub.ai/leeguooooo/skills/chrome-use skill-card.md:35
依赖与供应链
| 包名 | 版本 | 来源 | 漏洞 | 备注 |
|---|---|---|---|---|
| install.sh (remote script) | main branch, unpinned | https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | 否 | No integrity verification — script content mutable and fetched over HTTPS without hash verification |
文件构成
3 个文件 · 143 行
Markdown 2 个文件 · 138 行JSON 1 个文件 · 5 行
需关注文件 · 2
SKILL.md Undeclared remote shell script execution · Remote script from mutable source with no integrity check · Allowed-tools scope misrepresents actual shell behavior · curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh · https://dashboard.chrome-use.localhost
skill-card.md https://clawhub.ai/user/leeguooooo · https://clawhub.ai/leeguooooo/skills/chrome-use
其他文件 · _meta.json
安全亮点
MIT-0 license with clear attribution and publisher profile on ClawHub
skill-card.md explicitly warns against auto-running the remote installer — acknowledging the risk
The core chrome-use functionality (browser automation via CDP) is a legitimate and well-scoped use case
No evidence of credential harvesting or data exfiltration in the examined files
No obfuscation techniques (base64, eval) detected