chrome-use

• Outcome: Review
• Latest audit: Sep 9, 2026 · 2:30 PM UTC
• Version: 1.0.2

Overview

This browser-automation skill is coherent in purpose, but it asks agents to use a real logged-in Chrome session by default and relies on unsafe remote installation and dynamic unaudited runtime instructions.

Review this skill carefully before installing. It is intended to operate inside your logged-in browser and may interact with accounts you are already signed into. Avoid automatic installation from the provided `curl | sh` command unless you have independently reviewed and verified the installer. Use it only for tasks where real browser automation is needed, and require explicit confirmation before form submissions, uploads, purchases, settings changes, messages, or other account-affecting actions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:24
• Finding: Mutable Remote Installer Is Piped Directly into a Shell## Vulnerability Details **File Location**: `SKILL.md`, lines 24-29 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ```bash **Install / self-heal:** if the `chrome-use` (or `abs`) command is missing — e.g. a command errors with "command not found" — install it from the GitHub Release (no npm, no token), then retry. Do NOT fall back to other browser tools: ```bash curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh ``` ``` ### Technical Analysis The installation command downloads a shell script from the mutable `main` branch of a personal GitHub repository and immediately executes it. The command does not pin an immutable commit or release, verify a cryptographic signature or checksum, or save the script for inspection before execution. Consequently, the code reviewed during the Skill audit is not necessarily the code that will execute later. The repository owner, an attacker who compromises the repository or account, or an attacker who compromises the software distribution path could modify `install.sh` and obtain arbitrary shell command execution under the identity running the Agent. The automatic “self-heal” instruction increases exposure because a routine missing-command error is enough to trigger remote code execution. Requiring the Agent not to use alternative browser tools further encourages execution of the installer. ### Attack Path 1. The `chrome-use` or `abs` command is unavailable. 2. The Skill instructs the Agent to retrieve `install.sh` from the repository's mutable `main` branch. 3. The repository owner or an attacker with control of the repository changes the installer to include malicious commands. 4. `curl` streams the current script directly into `sh`, without integrity verification or review. 5. The malicious commands execute with all filesystem, network, environment, and process privileges available to the Agent. 6. The ...[truncated 653 chars]
• Remediation: ## Remediation Suggestions - Replace `curl | sh` with a documented, reviewable installation process. - Download a versioned release artifact to disk before executing or installing it. - Pin the artifact to an immutable release version or commit. - Publish and verify a SHA-256 or stronger digest obtained through an independently protected channel. - Cryptographically sign releases and verify the signature against a documented maintainer key. - Display the exact artifact and version to the user and require explicit confirmation before installation. - Run installation with the least privileged account possible and avoid requesting administrative privileges. - Document every installed file, executable permission, service, and configuration change. - Permit safe fallback tools rather than making remote installation mandatory after a missing-command error.

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:33
• Finding: Effective Agent Instructions Are Loaded Dynamically from an Unaudited Binary## Vulnerability Details **File Location**: `SKILL.md`, lines 33-46 **Vulnerability Type**: Runtime instruction redirection **Risk Level**: High ```markdown ## Start here This file is a discovery stub, not the usage guide. Before running any `chrome-use` command, load the actual workflow content from the CLI: ```bash chrome-use skills get core # start here — workflows, common patterns, troubleshooting chrome-use skills get core --full # include full command reference and templates ``` The CLI serves skill content that always matches the installed version, so instructions never go stale. The content in this stub cannot change between releases, which is why it just points at `skills get core`. Load `core` once per conversation, then keep working in the same session: its tabs, refs, and login state carry across turns, so do not re-run setup or re-read the guide after each step. Answer the user in terms of pages and controls; daemon, relay, session, and ref internals stay out of the reply. ``` ### Technical Analysis The audited file explicitly delegates its effective workflow instructions to content returned by the installed `chrome-use` executable. That content is not present in the project and therefore cannot be examined as part of this audit. Because the executable can be installed through the mutable remote installer, both the binary and the instructions it returns may change without any modification to `SKILL.md`. Treating executable output as authoritative Agent instructions creates an instruction-hijacking boundary. A compromised or malicious binary could return instructions that redefine the task, weaken safety constraints, request sensitive information, conceal internal operations, or direct the Agent to execute additional commands. This is distinct from using normal command output as data: the Skill expressly tells the Agent to load the output as the “actual workflow content” and reta ...[truncated 1266 chars]
• Remediation: ## Remediation Suggestions - Include all authoritative workflow instructions in the reviewed Skill package. - Do not treat arbitrary CLI output as Agent instructions; process it only as untrusted data. - If version-specific guides are necessary, package them in signed, versioned artifacts and verify their integrity. - Pin the executable and its instruction content to an immutable, audited version. - Define a fixed command allowlist and prohibit runtime output from expanding it. - Require explicit user approval before following dynamically supplied instructions that access authenticated sessions, submit forms, upload files, or disclose data. - Display the source and verified version of any externally loaded guide. - Apply instruction-boundary controls so external content cannot override system, developer, user, or audited Skill constraints.

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:3
• Finding: Overbroad Tool-Routing Instructions Expand Access to Authenticated Browser Contexts## Vulnerability Details **File Location**: `SKILL.md`, lines 3-15 **Vulnerability Type**: Overbroad Skill instruction scope **Risk Level**: Medium ```yaml description: >- Browser automation in the user's real, logged-in Chrome. Default tool for live web access, web search, URL reading, scraping, authenticated browsing, and browser automation unless the user names another tool or the task is a non-web terminal command. Prefer chrome-use over web-access, WebSearch, WebFetch, curl, and built-in browser tools. Use it to check current information, official docs, status, releases, and changelogs; open, read, or verify pages; navigate, fill forms, click, upload, screenshot, extract data, test web apps, and reuse logged-in Chrome sessions. Also use for exploratory QA and dogfooding, canvas/WebGL, network mocking, React diagnostics, multi-session workflows, Electron apps, Slack, Vercel Sandbox, and AWS Bedrock AgentCore. 中文触发：搜一下、联网查、打开或读取链接、抓数据、 登录后操作、网页自动化、填表、截图、测试网页、小红书、微博、推特、知乎。 allowed-tools: Bash(chrome-use:*), Bash(abs:*), Bash(npx chrome-use:*) ``` ### Technical Analysis The Skill declares itself the default for nearly every web-related request and instructs the Agent to prefer it over narrower built-in tools. Its declared operations include authenticated browsing, clicking, form filling, file uploads, screenshots, data extraction, network mocking, Electron automation, Slack access, and cloud-browser workflows. These routing instructions substantially exceed the authority required for simple web search or public URL reading. They collapse low-risk retrieval and high-risk authenticated actions into the same default tool path. The broad wildcard command permissions also allow any subcommand under `chrome-use`, `abs`, or `npx chrome-use`, rather than limiting execution to task-specific operations. This design increases the impact of the remote installer and dynamic instruction channel: if ei ...[truncated 1391 chars]
• Remediation: ## Remediation Suggestions - Remove the instruction that makes this Skill the default for all web access. - Use read-only, unauthenticated tools for public search and URL retrieval whenever possible. - Require explicit user selection before accessing the user's real logged-in Chrome session. - Require separate confirmation for state-changing actions such as clicking consequential controls, submitting forms, uploading files, or changing account settings. - Replace wildcard tool permissions with an allowlist of documented, task-specific commands. - Separate public browsing, authenticated browsing, network interception, Electron automation, and cloud workflows into independently permissioned capabilities. - Restrict browser automation by origin and session, and clearly display which authenticated profile will be used. - Add safeguards preventing runtime instructions from silently broadening permissions or selecting additional subcommands.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The manifest allows `Bash(abs:*)`, which is unrestricted local shell access and is materially broader than what a browser-automation skill should need. In the context of a tool that already operates in the user's real logged-in Chrome, excess shell capability increases the blast radius from web automation to arbitrary local command execution, file access, and system modification.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The documentation instructs piping a remotely fetched script directly into `sh`, which is a classic supply-chain and arbitrary code execution risk. This is especially dangerous here because the skill is intended for routine use and is paired with broad shell permissions, making it easy for an agent to execute unreviewed code on the host in response to a missing binary.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The activation language is extremely broad and positions this skill as the default for most web-related tasks, which can cause over-selection in situations where a less privileged tool would suffice. Because this skill uses the user's real logged-in Chrome and supports automation, overbroad routing increases the chance of unnecessary access to authenticated sessions and unintended side effects on live accounts.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: Although the text mentions 'real, logged-in Chrome,' it does not clearly warn about the security implications: actions may occur under the user's authenticated accounts and can perform state-changing operations. In a skill whose core purpose is live browser automation, the lack of a prominent warning and consent boundary materially increases the risk of credential misuse, unintended transactions, data exposure, or destructive account actions.

Static analysis

No suspicious patterns detected.