中文 EN
Start Review
Skill Trust Decision

chrome-use

chrome-use技能通过curl|sh从第三方GitHub仓库执行远程脚本安装，存在供应链攻击风险；动态运行时指令加载机制构成阴影功能，无法预扫描验证。

Install decision first Source: ClawHub Scanned: 1 day ago
Files 2
Artifacts 4
Violations 1
Findings 4
Most direct threat evidence
Critical Supply Chain
curl|sh远程脚本执行供应链攻击风险

SKILL.md第29行包含`curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh`，攻击者可通过篡改GitHub仓库内容注入恶意代码，完全绕过版本锁定和代码签名机制。

SKILL.md:29

Why this conclusion was reached

3/4 dimensions flagged
Block
Declared vs actual capability

1 undeclared or violating capabilities were inferred.

Block
Hidden execution and egress

1 high-risk artifacts or egress signals were extracted.

Block
Attack chain and severe findings

The report includes 4 attack-chain steps and 2 severe findings.

Pass
Dependencies and supply chain hygiene

Dependencies are present but no obvious high-risk issue stands out.

Attack Chain

01
用户读取SKILL.md被诱导执行安装命令

Entry · SKILL.md:29

02
curl从第三方GitHub下载install.sh并通过管道执行

Escalation · SKILL.md:29

03
动态加载chrome-use skills get运行时指令（阴影功能）

Escalation · skill-card.md:29

04
恶意代码通过install.sh或动态指令注入并执行

Impact · https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh:1

What drove the risk score up

curl|sh远程脚本执行 +35

SKILL.md:29 直接从GitHub下载并执行shell脚本，攻击者可随时篡改内容

动态运行时指令阴影功能 +25

skill-card.md:29承认动态加载CLI指令无法预扫描，构成未声明的代码路径

文档行为不符 +10

声称是'discovery stub'但包含完整安装和执行逻辑

Most important evidence

Critical Supply Chain

curl|sh远程脚本执行供应链攻击风险

SKILL.md第29行包含`curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh`，攻击者可通过篡改GitHub仓库内容注入恶意代码，完全绕过版本锁定和代码签名机制。

SKILL.md:29
要求publisher提供可验证的安装包（Homebrew公式、签名二进制、npm包），或先下载脚本审计内容
High Doc Mismatch

动态运行时指令阴影功能未声明

skill-card.md承认'动态unaudited运行时指令由CLI服务'，chrome-use skills get命令会从CLI动态加载不可预扫描的工作流内容，构成阴影功能。

skill-card.md:29
要求publisher明确声明动态加载的指令源，或提供静态完整的SKILL.md内容
Medium Supply Chain

依赖外部dashboard服务

SKILL.md:85引用dashboard.chrome-use.localhost，本地网络端口4848开放监控面板，可能成为横向移动目标。

SKILL.md:85
评估本地端口暴露风险，必要时限制dashboard访问
Low Priv Escalation

使用真实登录Chrome会话

skill-card.md承认可能操作用户已登录账户（社交媒体、邮箱、银行等），需确认前获得明确授权。

skill-card.md:18
执行前要求用户确认，仅在必要时使用，并避免自动提交敏感表单

Declared capability vs actual capability

Shell Pass
Declared WRITE
→
Inferred WRITE
SKILL.md:29 curl|sh命令
Browser Pass
Declared READ
→
Inferred READ
SKILL.md描述通过CDP控制Chrome
Network Block
Declared READ
→
Inferred WRITE
动态加载第三方远程指令

Suspicious artifacts and egress

Critical Dangerous Command
curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh

SKILL.md:29

Medium External URL
https://dashboard.chrome-use.localhost

SKILL.md:85

Medium External URL
https://clawhub.ai/user/leeguooooo

skill-card.md:9

Medium External URL
https://clawhub.ai/leeguooooo/skills/chrome-use

skill-card.md:39

Dependencies and supply chain

PackageVersionSourceKnown vulnNotes
install.sh 动态版本（无版本锁定） GitHub raw URL No 高危：内容由第三方控制，可被篡改
chrome-use CLI 运行时动态获取 chrome-use skills get No 阴影功能：实际执行的指令未在SKILL.md中声明

File composition

2 files · 145 lines
Markdown 2 files · 145 lines
Files of concern · 2
SKILL.md Markdown · 85 lines
curl|sh远程脚本执行供应链攻击风险 · 依赖外部dashboard服务 · curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh · https://dashboard.chrome-use.localhost
skill-card.md Markdown · 60 lines
动态运行时指令阴影功能未声明 · 使用真实登录Chrome会话 · https://clawhub.ai/user/leeguooooo · https://clawhub.ai/leeguooooo/skills/chrome-use

Security positives

skill-card.md主动披露了curl|sh和动态指令风险，显示publisher有一定安全意识
提供了表格化的skill路由指引，文档结构清晰
明确要求账户影响操作需显式确认