Passo - Remote Browser Access

• Analyzed: May 12, 2026, 4:32 AM
• Findings: 1
• Version: 1.0.0
• Hash: b00958b42787d6853b96ed4320e0a375af5231ae0dfb4de6f1a0f4644973d19c
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is suspicious due to the installation method specified in `SKILL.md`. It instructs the agent to execute an external script directly via `curl -fsSL ... | bash` from `https://raw.githubusercontent.com/felipegoulu/passo-client/main/install.sh`. This constitutes a critical remote code execution (RCE) vulnerability and a direct prompt injection against the agent, as it allows arbitrary, unreviewed code from an untrusted external source to be executed on the host system. While the stated purpose of 'Remote Browser Access' is not inherently malicious, this installation method poses a significant supply chain risk and could lead to data exfiltration, persistence, or other harmful actions if the external script were compromised or designed with malicious intent.