ClawHub
Back to skill

Security audit

Passo - Remote Browser Access

Security checks for vulnerabilities and agentic risk

Overview

This skill’s purpose is clear, but it asks users to run an unverified remote installer and encourages sharing sensitive browser login flows without enough safeguards.

Review this carefully before installing. Use it only on an isolated host or disposable browser profile, do not run the installer as root unless you have verified every step, and prefer downloading and inspecting a pinned installer with a published checksum. Avoid using it for highly sensitive accounts unless you fully trust the remote-access service and understand that live browser sessions can expose tokens, account data, and recovery flows.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:10
Finding

Mutable Remote Installer Is Downloaded and Executed Without Verification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 10
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

bash
curl -fsSL https://raw.githubusercontent.com/felipegoulu/passo-client/main/install.sh | bash

Technical Analysis

The installation instructions download a shell script from a personal GitHub repository and pipe its contents directly into Bash. The URL references the mutable main branch rather than an immutable commit or cryptographically verified release.

No checksum, digital signature, pinned revision, local review, or confirmation step protects the execution. Consequently, the code executed by users may differ from the code that existed when the Skill was reviewed. The remote installer is not included in the audited project, so its implementation and the claims that it installs Chromium, VNC, dependencies, and the passo command cannot be independently verified from the available artifact.

Installing browser and remote-access components may be necessary for the declared functionality. However, granting an unaudited, mutable shell script all permissions of the invoking user exceeds the minimum trust and execution scope necessary to perform that installation safely.

Attack Path

  1. An attacker compromises or otherwise gains control of the referenced GitHub account or repository.
  2. The attacker modifies install.sh on the main branch to include malicious shell commands.
  3. A user follows the installation command in SKILL.md.
  4. curl retrieves the modified script.
  5. The pipe sends the response directly to Bash without integrity verification or inspection.
  6. The malicious commands execute with the privileges of the invoking user.

Impact Assessment

Successful exploitation permits arbitrary command execution with the invoking user's privileges. This could allow access to that user's files, credentials, browser data, tokens, and other locally available se ...[truncated 532 chars]

Remediation
View remediation

Remediation Suggestions

  1. Do not pipe network responses directly into a shell.
  2. Include the complete installer in the Skill package so it can be reviewed alongside the instructions.
  3. If remote distribution is required, use an immutable, pinned commit or versioned release rather than the mutable main branch.
  4. Publish and verify a cryptographic checksum or trusted digital signature before execution.
  5. Download the installer to a local file, inspect it, and execute it only after verification.
  6. Document every required permission and avoid root execution unless a specific installation step strictly requires it.
  7. Separate privileged dependency installation from unprivileged application setup, granting elevation only to narrowly scoped commands.
  8. Pin and audit all dependencies installed by the script.
  9. Fail closed if integrity or signature verification does not succeed.

A safer installation pattern would resemble:

bash
curl -fSLo install.sh "https://example.invalid/releases/passo/install.sh"
echo "EXPECTED_SHA256  install.sh" | sha256sum --check -
less install.sh
bash install.sh

The placeholder URL and digest must be replaced with a trusted, immutable release location and its independently published checksum.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The use of | bash creates an execution chain where untrusted remote content is run immediately on the server, magnifying the risk from any compromise of the source or delivery channel. In this skill's context, the server is being prepared to host remote browser access, so compromise could expose the host, browser data, user sessions, and any connected internal resources.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

Run this on the server where you want the browser:

bash
curl -fsSL https://raw.githubusercontent.com/felipegoulu/passo-client/main/install.sh | bash

The script will:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly facilitates sharing a live browser session for logins, 2FA, and captcha solving, which can expose authenticated sessions, sensitive data, tokens, and account recovery flows to another party. In this context, the danger is elevated because the skill normalizes handing off manual control during highly sensitive authentication steps without clearly warning about session hijacking, privacy leakage, or least-privilege boundaries.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The installation command fetches a remote script from GitHub and immediately executes it with bash, providing no opportunity to inspect integrity or contents before execution. If the upstream repository, network path, or referenced script is compromised, this becomes arbitrary code execution on the target server.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

Run this on the server where you want the browser:

bash
curl -fsSL https://raw.githubusercontent.com/felipegoulu/passo-client/main/install.sh | bash

The script will:

Static analysis

No suspicious patterns detected.