WSL Chrome CDP

PassAudited by ClawScan on May 10, 2026.

Overview

This skill is coherent for WSL-to-Windows Chrome automation, but it starts Chrome with a DevTools debugging port, so users should keep that port local and close the debug browser when finished.

This appears to be a legitimate WSL2 Chrome CDP helper. Before installing, understand that it can launch a separate Chrome debugging profile and expose a DevTools port on 9222. Do not open that port broadly in Windows Firewall unless you understand the network exposure, and close the debug Chrome session when you no longer need browser automation.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

Other local or permitted network processes that can reach the CDP port may be able to control the debug Chrome profile.

Why it was flagged

The script intentionally launches Chrome with a DevTools Protocol debugging port, which enables browser control. It uses a separate Debug profile, making the behavior purpose-aligned, but the port should be treated as sensitive.

Skill content

ps_command='Start-Process "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" -ArgumentList "--remote-debugging-port=9222","--user-data-dir=C:\\Users\\$env:USERNAME\\AppData\\Local\\Google\\Chrome\\Debug","--no-first-run"'

Recommendation

Use this only on trusted machines, keep port 9222 restricted to localhost/WSL access, avoid broad firewall exposure, and close the debug Chrome instance when done.

NoteHigh Confidence

ASI05: Unexpected Code Execution

What this means

Installing or invoking the skill can start a Windows Chrome process from the WSL environment.

Why it was flagged

The skill executes a Windows PowerShell command from WSL to start Chrome. This is disclosed and necessary for the stated WSL2/Windows integration.

Skill content

$POWERShell -Command "$ps_command"

Recommendation

Review the script before use and run it only in the intended Windows + WSL2 environment.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Some documented or declared helper paths may not work as written, and users should avoid substituting unreviewed files from elsewhere.

Why it was flagged

The manifest references scripts paths, including start-chrome-debug.bat, while the provided file manifest only includes enable-browser.sh at the package root and no scripts directory. This looks like a packaging inconsistency.

Skill content

permissions:
  - exec:scripts/enable-browser.sh
  - exec:scripts/start-chrome-debug.bat

Recommendation

Use the included enable-browser.sh only, and ask the maintainer to align the manifest, documentation, and shipped files.