Security audit

chrome-use

Security checks for vulnerabilities and agentic risk

Overview

Review is advised because this browser skill automatically runs changeable installation scripts and offers updates that affect other installed tools.

Before installing, review and verify a fixed release instead of automatically executing the remote installer. Keep updates limited to chrome-use unless you explicitly want the whole tool family changed. Use a browser profile containing only accounts you intend the agent to access, and authorize consequential account actions explicitly.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The pipe directly connects externally controlled content to a command interpreter, removing any review or verification boundary before execution. This confirms the same unsafe installation mechanism reported by SC2 and SQP-2, rather than establishing a separate malicious chaining attack.
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
If chrome-use is missing, install the GitHub Release binary, then load core:

bash
curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh

On Windows, in PowerShell:

Manifest references MCP server without version pin: 'npx chrome-use'.

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: MCP server references in the skill manifest without version pinning are a rug-pull risk.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx chrome-use'.

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.
md
When the task is finished, end it with `chrome-use done`, adding `--keep <tab>` only for tabs the user still needs (a page they asked to see, a result to act on, a login left for them). Decide this yourself; never ask the user which tabs to close. Everything else you opened is closed. If `chrome-use` is missing, install the GitHub Release binary, then load core:

Automatic installation executes downloaded code without a user-facing warning about system changes.

Medium

Category: Output Handling
Confidence: 99% confidence
Finding: The skill directs the agent to install missing software by immediately executing a downloaded shell or PowerShell script, without explicitly obtaining approval for local system changes. These mutable remote scripts run with the agent process's privileges; compromise could affect local files and credentials, with additional exposure because the intended tool operates against logged-in Chrome.
Content: No source excerpt is available for this finding.

External Script Fetching

Low

Category: Supply Chain
Confidence: 99% confidence
Finding: The command fetches an installation script from a mutable main branch and executes it immediately without checking its contents or integrity. A compromised repository or malicious upstream change could therefore execute arbitrary commands with the agent's local privileges; HTTPS alone does not protect against upstream compromise.
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
If chrome-use is missing, install the GitHub Release binary, then load core:

bash
curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh

On Windows, in PowerShell:

External Script Fetching

Low

Category: Supply Chain
Confidence: 99% confidence
Finding: The family-upgrade command immediately executes an unverified script from a mutable branch, creating another remote-code-execution supply-chain exposure. Its stated scope covers multiple tools, so changes may extend beyond the specific browser skill the user intended to update, although the script's actual behavior is not provided.
Content: Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.
md
If the skill came from somewhere `upgrade` can't refresh: - Claude Code plugin: `claude plugin update chrome-use@leeguooooo-plugins` - Whole family: `curl -fsSL https://raw.githubusercontent.com/leeguooooo/plugins/main/upgrade-use-family.sh | sh`

Static analysis

No suspicious patterns detected.