chrome-use@1.5.291
CAUTION· install onlyPublisher claims: "Let Claude Code, Codex and any AI agent use the Chrome you're already signed in to. Open-source CLI + MCP server + Chrome extension (native messaging, no debug port); stealth by default." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Install scripts ran; no agent task scenario for this bundle.- Tested
- install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
AI_GATEWAY_API_KEYCWS_CLIENT_SECRETCWS_REFRESH_TOKENGITHUB_TOKENTEXT_MODEL_API_KEYTYPESAFE_API_KEYConfiguration, not credentials: __CFBundleIdentifier, AGENT_BROWSER_ACTION_POLICY, AGENT_BROWSER_ALLOWED_DOMAINS, AGENT_BROWSER_ARGS, AGENT_BROWSER_AS, AGENT_BROWSER_AUTO_LOGIN, AGENT_BROWSER_BIN_DIR, AGENT_BROWSER_BROWSER, AGENT_BROWSER_CLICK_MODE, AGENT_BROWSER_COLOR_SCHEME, AGENT_BROWSER_CONFIG, AGENT_BROWSER_CONFIRM_ACTIONS, AGENT_BROWSER_CONTENT_BOUNDARIES, AGENT_BROWSER_DAEMON, AGENT_BROWSER_DASHBOARD, AGENT_BROWSER_DASHBOARD_PORT, AGENT_BROWSER_DEBUG, AGENT_BROWSER_DEFAULT_TIMEOUT, AGENT_BROWSER_DOWNLOAD_PATH, AGENT_BROWSER_ENABLE, AGENT_BROWSER_ENGINE, AGENT_BROWSER_EXECUTABLE_PATH, AGENT_BROWSER_EXTENSIONS, AGENT_BROWSER_HUMANIZE, AGENT_BROWSER_IDLE_TIMEOUT_MS, AGENT_BROWSER_INIT_SCRIPTS, AGENT_BROWSER_IOS_DEVICE, AGENT_BROWSER_MAX_OUTPUT, AGENT_BROWSER_NO_AUTO_OPEN, AGENT_BROWSER_NO_AUTO_RECONNECT, AGENT_BROWSER_NO_FRICTION_LOG, AGENT_BROWSER_NO_REPORT_HINTS, AGENT_BROWSER_NO_SKILL, AGENT_BROWSER_OPENCLI_TIMEOUT- Where it talks to
- chrome-use.localhost (its own)Also a.example, x.com, githubusercontent.com, apple.com, shop.example, nodejs.org, claude.ai, example.org, 1password.com, example.net, evil.net, no-color.org, x.test, b.com, a.com, first.example, second.example, destination.test, google.com, example.invalid, x.example, openrouter.ai, typesafe.ai, proxy.com, rule.example, b.example, perfetto.dev, gmail.com, vercel.sh — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- use of the skill by an agent
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names a.example, x.com, githubusercontent.com, apple.com, shop.example, nodejs.org, claude.ai, example.org, 1password.com, example.net, evil.net, no-color.org, x.test, b.com, a.com, first.example, second.example, destination.test, google.com, example.invalid, x.example, openrouter.ai, typesafe.ai, proxy.com, rule.example, b.example, perfetto.dev, gmail.com, vercel.sh as well as its own vendor. The guard injects AI_GATEWAY_API_KEY, CWS_CLIENT_SECRET, CWS_REFRESH_TOKEN, GITHUB_TOKEN, TEXT_MODEL_API_KEY, TYPESAFE_API_KEY only into requests to chrome-use.localhost (and its subdomains) and refuses the rest.
$vet-skills run --secrets AI_GATEWAY_API_KEY=chrome-use.localhost,CWS_CLIENT_SECRET=chrome-use.localhost,CWS_REFRESH_TOKEN=chrome-use.localhost,GITHUB_TOKEN=chrome-use.localhost,TEXT_MODEL_API_KEY=chrome-use.localhost,TYPESAFE_API_KEY=chrome-use.localhost -- <the server's command>
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; install scripts ran; no agent task scenario for this bundle) on 2026-11-13 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Prompt injection; Pipe-to-shell pattern; Pipe-to-shell pattern. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 1 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessinstall script run in the sandbox
0.1sprocessexited 1: Node.js v22.23.5
0.1sprocessscript backend runs setup only
0.1sprocessscript backend runs setup only
0.2sprocesssecond launch, clock +45 days, CI unset
0.3sprocessexited 1: Node.js v22.23.5
Static findings
CRITICAL
Prompt injectionskill-data/real-chrome/SKILL.md:20 · Prompt injection — known jailbreak technique reference
AST01(Dev fallback: `chrome://extensions` → Developer mode → *Load unpacked* →Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.CRITICAL
Pipe-to-shell patterncli/src/upgrade.rs:743 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06.arg(format!("curl -fsSL {INSTALL_URL} | sh"))Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.CRITICAL
Pipe-to-shell patterncli/src/mcp.rs:2379 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06"structuredContent": {"stdout": "...", "response": {"data": {"text": "run curl x | sh", "origin": "http://127.0.0.1:18933/kettle-131.html"}}},Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.CRITICAL
Pipe-to-shell patterncli/src/mcp.rs:2378 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06"content": [{"type": "text", "text": "{\"data\":{\"text\":\"run curl x | sh\"}}"}],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.CRITICAL
Pipe-to-shell patterncli/src/upgrade.rs:1324 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06eprintln!(" curl -fsSL {} | sh", INSTALL_URL);Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.CRITICAL
Pipe-to-shell patterncli/src/upgrade.rs:1305 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06let install_cmd = format!("curl -fsSL {} | sh", INSTALL_URL);Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.CRITICAL
Pipe-to-shell patterncli/src/upgrade.rs:521 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06format!("curl -fsSL {INSTALL_URL} | sh")Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Access to sensitive file pathscli/src/upgrade.rs:744 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05.env("AGENT_BROWSER_NO_SETUP", "1")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Direct script execution from GitHub raw URLcli/src/upgrade.rs:36 · Direct script execution from GitHub raw URL — unverified code source
AST06const INSTALL_URL: &str = "https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh";Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
URL with embedded credentialscli/src/report.rs:1746 · URL with embedded credentials — may be phishing or credential leaking
AST07let out = red("open https://user:[email protected]/x");Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandskill-data/vercel-sandbox/SKILL.md:64 · Privileged sudo command — agent may execute with elevated privileges
AST05`sudo dnf clean all 2>&1 && sudo dnf install -y --skip-broken ${CHROMIUM_SYSTEM_DEPS.join(" ")} 2>&1 && sudo ldconfig 2>&1`,Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathscli/src/connect.rs:6911 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05assert_eq!(sanitize_profile_id("../etc/passwd"), ".._etc_passwd");Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathscli/src/bwu_login.rs:924 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05.env(ITEM, &p.name)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Authorization escalation languageskill-data/real-chrome/SKILL.md:20 · Authorization escalation language
AST01(Dev fallback: `chrome://extensions` → Developer mode → *Load unpacked* →Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Access to sensitive file pathscli/src/upgrade.rs:1215 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05.env("CHROME_USE_NO_UPDATE_CHECK", "1")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Auto-update or dynamic fetch configurationcli/src/upgrade.rs:466 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06/// Background CLI auto-update: on unless `CHROME_USE_AUTO_UPGRADE` says off.Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
document.cookie accesscli/src/site.rs:2127 · document.cookie access — can steal session cookies
AST07out.loggedInHint = document.cookie.length > 0;Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.HIGH
Access to sensitive file pathscli/src/connect.rs:5750 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05.env("CHROME_USE_RELAY_DIR", root.join("wrong inherited relay"))Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Direct script execution from GitHub raw URLskill-data/real-chrome/SKILL.md:94 · Direct script execution from GitHub raw URL — unverified code source
AST06curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | shFix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathscli/src/site.rs:3420 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05assert_eq!(parse_owner_repo("../etc/passwd"), None);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Direct script execution from GitHub raw URLcli/src/bwu_login.rs:142 · Direct script execution from GitHub raw URL — unverified code source
AST06https://raw.githubusercontent.com/leeguooooo/bitwarden-use/main/install.sh | sh"Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Privileged sudo commandcli/src/install.rs:706 · Privileged sudo command — agent may execute with elevated privileges
AST05eprintln!(" sudo apt-get install {}", deps.join(" "));Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandcli/src/install.rs:407 · Privileged sudo command — agent may execute with elevated privileges
AST05eprintln!(" sudo apt install chromium-browser # Debian/Ubuntu");Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathscli/src/bwu_login.rs:926 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05.env(FIELDS, serde_json::to_string(&p.custom).unwrap_or_default());Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandcli/src/install.rs:643 · Privileged sudo command — agent may execute with elevated privileges
AST05println!("Running: sudo apt-get update");Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Auto-update or dynamic fetch configurationcli/src/upgrade.rs:642 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06/// install.sh `~/.local/bin`, not a Homebrew/apt/system path. Auto-update onlyFix: Pin versions and sources; vendor anything fetched at install time.HIGH
URL with embedded credentialscli/src/output.rs:7231 · URL with embedded credentials — may be phishing or credential leaking
AST07Supports authenticated proxies: --proxy "http://user:[email protected]:7890"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
AWS access key pattern detectedcli/src/report.rs:1769 · AWS access key pattern detected — possible hardcoded or harvested key
AST03"AKIAABCDEFGHIJKLMNOP",Fix: Never read or enumerate credential locations; accept a documented environment variable instead.HIGH
Access to sensitive file pathscli/src/bwu_login.rs:925 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05.env(ITEM_ID, &p.id)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathscli/src/output.rs:7974 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05.env("NO_COLOR", "1")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandcli/src/install.rs:722 · Privileged sudo command — agent may execute with elevated privileges
AST05let install_cmd = format!("sudo apt-get install -y {}", deps.join(" "));Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathscli/src/connection.rs:1638 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05.env(Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathscli/src/connection.rs:1632 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05.env("AGENT_BROWSER_SESSION", session)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathscli/src/site.rs:3406 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05assert!(load_adapter("../etc/passwd").is_err());Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandcli/src/install.rs:408 · Privileged sudo command — agent may execute with elevated privileges
AST05eprintln!(" sudo dnf install chromium # Fedora");Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathscli/src/main.rs:2005 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05.env("AGENT_BROWSER_DASHBOARD_PORT", port.to_string());Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
document.cookie accessskill-data/real-chrome/SKILL.md:255 · document.cookie access — can steal session cookies
AST07mints a `cf_clearance` cookie (HttpOnly — invisible to `eval`/`document.cookie`;Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.HIGH
URL with embedded credentialscli/src/main.rs:5687 · URL with embedded credentials — may be phishing or credential leaking
AST07let result = parse_proxy("http://user:p@ss:[email protected]:8080");Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Pipe-to-shell patternskill-data/real-chrome/SKILL.md:94 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Access to sensitive file pathscli/src/bwu_login.rs:923 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05.env(ORIGIN, &p.origin)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
document.cookie accesscli/src/site.rs:2123 · document.cookie access — can steal session cookies
AST07cookies: document.cookie.split(';').map(c => c.trim().split('=')[0]).filter(Boolean),Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.HIGH
Access to sensitive file pathscli/src/output.rs:8200 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05.env("NO_COLOR", "1")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Direct script execution from GitHub raw URLcli/src/gui_setup.rs:199 · Direct script execution from GitHub raw URL — unverified code source
AST06"chrome-use could not finish setting up: {error}\n\nInstall from a terminal instead:\ncurl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh\n\nLog: {log}"Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathscli/src/profiles.rs:2476 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05.env(DB, &db)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathscli/src/connect.rs:6774 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05.env("CHROME_USE_RELAY_DIR", dir.path())Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathscli/src/output.rs:7973 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05.env(KEY, case)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathscli/src/output.rs:8199 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05.env(KEY, case)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathscli/src/connect.rs:5749 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05.env("HOME", root.join("wrong inherited home"))Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathscli/src/gui_setup.rs:285 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05.env("CHROME_USE_NO_UPDATE_CHECK", "1")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
URL with embedded credentialscli/src/main.rs:5649 · URL with embedded credentials — may be phishing or credential leaking
AST07let result = parse_proxy("http://user:[email protected]:8080");Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Direct script execution from GitHub raw URLcli/src/gui_setup.rs:195 · Direct script execution from GitHub raw URL — unverified code source
AST06"chrome-use 没装好：{error}\n\n可以改用终端安装：\ncurl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh\n\n日志：{log}"Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathscli/src/connect.rs:6773 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05.env(KEY, "1")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Auto-update or dynamic fetch configurationcli/src/upgrade.rs:390 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06// Background auto-update, on by default (`CHROME_USE_AUTO_UPGRADE=0`Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathscli/src/gui_setup.rs:269 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05.env("CHROME_USE_NO_UPDATE_CHECK", "1")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathscli/src/profiles.rs:2477 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05.env("PATH", &bin)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Process kill commandcli/src/silence.rs:520 · Process kill command — agent can terminate processes
AST05// saves its session. `/F` (or PowerShell Stop-Process) would force-kill andFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
npx invocation of non-well-known packagecli/src/upgrade.rs:958 · npx invocation of non-well-known package — may execute untrusted code
AST06(Channel::Copied, format!("npx skills update {NAME}"))Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Process kill commandcli/src/connection.rs:2149 · Process kill command — agent can terminate processes
AST05// version (e.g. after an upgrade), kill it and start a fresh one.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandskill-data/vercel-sandbox/SKILL.md:197 · Privileged sudo command — agent may execute with elevated privileges
AST05`sudo dnf clean all 2>&1 && sudo dnf install -y --skip-broken ${CHROMIUM_SYSTEM_DEPS.join(" ")} 2>&1 && sudo ldconfig 2>&1`,Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandcli/src/connection.rs:2086 · Process kill command — agent can terminate processes
AST05// Force-kill if still aliveFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Remote installer piped to shellcli/src/mcp.rs:2379 · Remote installer piped to shell
AST07"structuredContent": {"stdout": "...", "response": {"data": {"text": "run curl x | sh", "origin": "http://127.0.0.1:18933/kettle-131.html"}}},Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Remote installer piped to shellcli/src/upgrade.rs:521 · Remote installer piped to shell
AST07format!("curl -fsSL {INSTALL_URL} | sh")Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
npx invocation of non-well-known packageskill-data/sessions/SKILL.md:4 · npx invocation of non-well-known package — may execute untrusted code
AST06allowed-tools: Bash(chrome-use:*), Bash(npx chrome-use:*)Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Pipe-to-shell patternskills/chrome-use/SKILL.md:43 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
npx invocation of non-well-known packageskill-data/core/SKILL.md:4 · npx invocation of non-well-known package — may execute untrusted code
AST06allowed-tools: Bash(chrome-use:*), Bash(npx chrome-use:*)Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagecli/src/output.rs:5642 · npx invocation of non-well-known package — may execute untrusted code
AST06copied folders prints `npx skills update chrome-use`Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Python subprocess execution detectedcli/src/flags.rs:643 · Python subprocess execution detected
AST05/// `subprocess.run(env=...)`) loses the agent id the session name is keyed onFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
npx invocation of non-well-known packageskill-data/react/SKILL.md:4 · npx invocation of non-well-known package — may execute untrusted code
AST06allowed-tools: Bash(chrome-use:*), Bash(npx chrome-use:*)Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Direct script execution from GitHub raw URLskills/chrome-use/SKILL.md:43 · Direct script execution from GitHub raw URL — unverified code source
AST06curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | shFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packageskill-data/slack/SKILL.md:4 · npx invocation of non-well-known package — may execute untrusted code
AST06allowed-tools: Bash(chrome-use:*), Bash(npx chrome-use:*)Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Pipe-to-shell patternskills/chrome-use/SKILL.md:65 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06- Whole family: `curl -fsSL https://raw.githubusercontent.com/leeguooooo/plugins/main/upgrade-use-family.sh | sh`Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
npx invocation of non-well-known packageskill-data/canvas/SKILL.md:4 · npx invocation of non-well-known package — may execute untrusted code
AST06allowed-tools: Bash(chrome-use:*), Bash(npx chrome-use:*)Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packageskill-data/electron/SKILL.md:4 · npx invocation of non-well-known package — may execute untrusted code
AST06allowed-tools: Bash(chrome-use:*), Bash(npx chrome-use:*)Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packageskill-data/network/SKILL.md:4 · npx invocation of non-well-known package — may execute untrusted code
AST06allowed-tools: Bash(chrome-use:*), Bash(npx chrome-use:*)Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Remote installer piped to shellcli/src/mcp.rs:2378 · Remote installer piped to shell
AST07"content": [{"type": "text", "text": "{\"data\":{\"text\":\"run curl x | sh\"}}"}],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Remote installer piped to shellcli/src/upgrade.rs:743 · Remote installer piped to shell
AST07.arg(format!("curl -fsSL {INSTALL_URL} | sh"))Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Access to sensitive file pathsskill-data/vercel-sandbox/SKILL.md:55 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05...credentials,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packagecli/src/upgrade.rs:1739 · npx invocation of non-well-known package — may execute untrusted code
AST06assert_eq!(copied[0].update, "npx skills update chrome-use");Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File permission modification commandbin/chrome-use.js:108 · File permission modification command — agent changes file ownership/permissions
AST05console.error('Try running: chmod +x ' + binaryPath);Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Remote installer piped to shellcli/src/gui_setup.rs:195 · Remote installer piped to shell
AST07"chrome-use 没装好：{error}\n\n可以改用终端安装：\ncurl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh\n\n日志：{log}"Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
npx invocation of non-well-known packagepackages/push-worker/package.json:12 · npx invocation of non-well-known package — may execute untrusted code
AST06"deploy": "npx wrangler@4 deploy"Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Process kill commandskill-data/sessions/SKILL.md:74 · Process kill command — agent can terminate processes
AST05chrome-use daemon restart # kill every session daemon workerFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandcli/src/main.rs:2254 · Process kill command — agent can terminate processes
AST05// Force-kill the process and clean up stale files so futureFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
npx invocation of non-well-known packageskill-data/dogfood/SKILL.md:25 · npx invocation of non-well-known package — may execute untrusted code
AST06Always use `chrome-use` directly -- never `npx chrome-use`. The direct binary uses the fast Rust client. `npx` routes through Node.js and is significantly slower.Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packageskill-data/dogfood/SKILL.md:4 · npx invocation of non-well-known package — may execute untrusted code
AST06allowed-tools: Bash(chrome-use:*), Bash(npx chrome-use:*)Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Remote installer piped to shellskills/chrome-use/SKILL.md:65 · Remote installer piped to shell
AST07- Whole family: `curl -fsSL https://raw.githubusercontent.com/leeguooooo/plugins/main/upgrade-use-family.sh | sh`Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Process kill commandcli/src/connection.rs:3003 · Process kill command — agent can terminate processes
AST05// unknown outcomes, not permission to kill that daemon or retry.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandcli/src/silence.rs:19 · Process kill command — agent can terminate processes
AST05//! - on quit, wait generously and NEVER force-kill (a force kill loses tabs).Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
npx invocation of non-well-known packagecli/src/skills.rs:24 · npx invocation of non-well-known package — may execute untrusted code
AST06/// bootstrap stubs that exist for external tooling (e.g. `npx skills add`)Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Python subprocess execution detectedscripts/cws.py:89 · Python subprocess execution detected
AST05sig = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Remote installer piped to shellcli/src/upgrade.rs:1305 · Remote installer piped to shell
AST07let install_cmd = format!("curl -fsSL {} | sh", INSTALL_URL);Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
npx invocation of non-well-known packagecli/src/skills.rs:37 · npx invocation of non-well-known package — may execute untrusted code
AST06/// - `skills/` — discovery stubs (picked up by `npx skills add`). Hidden fromFix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathsskill-data/vercel-sandbox/SKILL.md:59 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05: await Sandbox.create({ ...credentials, runtime: "node24", timeout: 120_000 });Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packagebin/chrome-use.js:6 · npx invocation of non-well-known package — may execute untrusted code
AST06* This wrapper enables npx support on Windows where shell scripts don't work.Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packageskill-data/real-chrome/SKILL.md:4 · npx invocation of non-well-known package — may execute untrusted code
AST06allowed-tools: Bash(chrome-use:*), Bash(npx chrome-use:*)Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Process kill commandcli/src/silence.rs:286 · Process kill command — agent can terminate processes
AST05/// kills — a force kill would lose the user's session.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
npx invocation of non-well-known packageskill-data/agentcore/SKILL.md:4 · npx invocation of non-well-known package — may execute untrusted code
AST06allowed-tools: Bash(chrome-use:*), Bash(npx chrome-use:*)Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Remote installer piped to shellcli/src/upgrade.rs:1324 · Remote installer piped to shell
AST07eprintln!(" curl -fsSL {} | sh", INSTALL_URL);Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Remote installer piped to shellcli/src/gui_setup.rs:199 · Remote installer piped to shell
AST07"chrome-use could not finish setting up: {error}\n\nInstall from a terminal instead:\ncurl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh\n\nLog: {log}"Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Remote installer piped to shellskills/chrome-use/SKILL.md:43 · Remote installer piped to shell
AST07curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
npx invocation of non-well-known packagepackages/push-worker/package.json:11 · npx invocation of non-well-known package — may execute untrusted code
AST06"dev": "npx wrangler@4 dev",Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Remote installer piped to shellskill-data/real-chrome/SKILL.md:94 · Remote installer piped to shell
AST07curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Process kill commandcli/src/connection.rs:1895 · Process kill command — agent can terminate processes
AST05/// Kill a running daemon by reading its PID file and sending a kill signal.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
npx invocation of non-well-known packagecli/src/upgrade.rs:818 · npx invocation of non-well-known package — may execute untrusted code
AST06/// A copied folder the CLI does not own (e.g. `npx skills add`).Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Direct script execution from GitHub raw URLskills/chrome-use/SKILL.md:65 · Direct script execution from GitHub raw URL — unverified code source
AST06- Whole family: `curl -fsSL https://raw.githubusercontent.com/leeguooooo/plugins/main/upgrade-use-family.sh | sh`Fix: Pin versions and sources; vendor anything fetched at install time.LOW
Prompt injectionscripts/inspect-acceptance/branded/README.md:11 · Prompt injection — known jailbreak technique reference · informational: not an instruction file
AST01Chrome on a fresh profile, turns on developer mode and opens "Load unpacked";Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.LOW
Unpinned dependencycli/src/upgrade.rs:1239 · Unpinned dependency
AST06/// ran `npm/pnpm install -g chrome-use@latest`, which installed theFix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.LOW
Authorization escalation languagescripts/inspect-acceptance/branded/README.md:11 · Authorization escalation language · informational: not an instruction file
AST01Chrome on a fresh profile, turns on developer mode and opens "Load unpacked";Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
npx invocation of non-well-known packageskills/chrome-use/SKILL.md:16 · npx invocation of non-well-known package — may execute untrusted code
AST06allowed-tools: Bash(chrome-use:*), Bash(npx chrome-use:*)Fix: Pin versions and sources; vendor anything fetched at install time.Cost to the agent
Instructions loaded
≈23,634 tok
14 files · 80 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.
What would make this Verified
12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
- Unclaimed publisher≈ +8 on the totalClaim leeguooooo: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Direct script execution from GitHub raw URL≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
- URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to Glama, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim leeguoooooPropose a patch to the maintainer