Security audit
Security checks for vulnerabilities and agentic risk
This skill is openly a browser session manager, but it gives agents broad power to capture, replay, share, and bypass confirmation for live account sessions.
Install only if you fully trust the publisher and need this for accounts you own or administer. Avoid using it with personal, production, financial, or third-party accounts unless you have explicit authorization, and avoid the confirmation bypass, session sharing, and production-to-localhost replay workflows. Review and verify any installer manually instead of running the documented curl-to-shell commands.
SKILL.md:24Unverified Remote Installation Scripts Executed Directly by Shell
The skill operationalizes capture, storage, switching, replay, and sharing of live authenticated sessions across browsers and accounts. In context, this is effectively a session hijacking and impersonation framework, and the "agent identity" feature normalizes acting as other accounts without reauthentication.
The curl-to-shell pattern is also an example of dangerous tool chaining: one tool retrieves untrusted content and immediately passes it to a shell interpreter. This compresses review opportunities to zero and amplifies the blast radius of a single compromised upstream artifact.
NOT fall back to other tools:
curl -fsSL https://raw.githubusercontent.com/leeguooooo/cookie-use/main/install.sh | sh
cookie-use requires chrome-use on PATH. If that's missing too:
Repeating the same chained fetch-and-execute pattern for the dependency compounds the risk and normalizes unsafe installation behavior. A compromise in either project can lead to arbitrary command execution on the endpoint.
cookie-use requires chrome-use on PATH. If that's missing too:
curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh
macOS only (uses the Keychain for the vault key and chrome-use's macOS cookie
The skill relies on macOS Keychain access and chrome-use cookie decryption to obtain browser session material. While Keychain use for local encryption is not inherently unsafe, in this context it supports extraction and reuse of authenticated cookies, which is credential access behavior with substantial takeover risk if misused.
curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh
macOS only (uses the Keychain for the vault key and chrome-use's macOS cookie
decryption).
## Mental model
The skill captures and stores full session material, including cookies and optionally localStorage that may contain bearer tokens or user identity data, then makes reuse and sharing a routine workflow. Even if encrypted at rest, centralizing reusable session artifacts materially increases the blast radius of host compromise, misuse by an agent, or accidental export.
The --no-confirm parameter is a high-risk option that can be abused by an agent or attacker to suppress the only interactive approval step before session injection. In a skill dedicated to account switching and reuse, this materially lowers the barrier to covert impersonation.
# "http://localhost:8001"); pair with --rewrite-domain.
# --no-localstorage skip injecting the account's captured localStorage
# (injected by default when present and a page opens).
# --no-confirm skip the Touch ID / TTY gate before injecting.
# Cross-origin QA sugar: replay a captured session onto a local dev origin.
cookie-use replay <id> --to localhost:8001 # = use --rewrite-domain localhost
The environment-variable bypass makes parameter abuse even easier because agents can set COOKIE_USE_YES=1 programmatically without changing the visible command line. This reduces detectability and facilitates unattended misuse of stored sessions.
Injecting a live session is the dangerous action, so `use` / `switch` / `replay`
/ `as` confirm before they inject: **Touch ID** on macOS (LocalAuthentication),
falling back to a TTY y/N prompt. An agent driving the CLI non-interactively
must either pass `--no-confirm` or set `COOKIE_USE_YES=1`; without a bypass,
injection is *refused* in a non-interactive shell rather than proceeding
silently.
The localhost replay workflow explicitly teaches transplanting a production session, including token-bearing localStorage, into a different trust boundary. This can expose production credentials to insecure local development stacks, debugging tools, browser extensions, and apps not designed to protect live customer sessions.
The manifest description is intentionally broad and encourages invocation for managing accounts on virtually any website, including multiple ChatGPT/Claude accounts. In a skill whose core function is capturing and replaying authenticated sessions, broad trigger language increases the chance the agent invokes a high-risk capability in situations involving credential handling or impersonation.
The skill instructs piping remote install scripts directly to the shell from GitHub without integrity verification or an explicit warning. This creates a straightforward supply-chain execution path where a compromised repository, MITM in a misconfigured environment, or malicious update results in arbitrary code execution on the host.
The rewrite-domain capability enables applying captured cookies to a different origin such as localhost, effectively persisting a session outside its original security boundary. This undermines site scoping assumptions and can expose valid sessions to less trusted environments or alternate applications.
cookie-use use <id> --target isolated # spin up a throwaway browser with this account
cookie-use switch <id> --target session:<name> # clear the site's cookies, then apply
# add --no-open to skip opening the site after applying.
# --rewrite-domain <host> rewrite cookie domains on apply (e.g. "localhost")
# so a prod/test session works on a different origin.
# --open-url <url> open this exact URL afterwards (e.g. a dev server's
# "http://localhost:8001"); pair with --rewrite-domain.
The documented --no-confirm flag disables the interactive safeguard before injecting a live session into a browser. In an agent context, this removes a key human-in-the-loop control and enables autonomous session takeover or impersonation without contemporaneous user consent.
# "http://localhost:8001"); pair with --rewrite-domain.
# --no-localstorage skip injecting the account's captured localStorage
# (injected by default when present and a page opens).
# --no-confirm skip the Touch ID / TTY gate before injecting.
# Cross-origin QA sugar: replay a captured session onto a local dev origin.
cookie-use replay <id> --to localhost:8001 # = use --rewrite-domain localhost
The skill explicitly instructs agents to bypass Touch ID or TTY confirmation using --no-confirm or COOKIE_USE_YES=1 in non-interactive shells. This turns a safety feature into an optional obstacle and makes autonomous credential/session injection an intended operating mode.
Injecting a live session is the dangerous action, so `use` / `switch` / `replay`
/ `as` confirm before they inject: **Touch ID** on macOS (LocalAuthentication),
falling back to a TTY y/N prompt. An agent driving the CLI non-interactively
must either pass `--no-confirm` or set `COOKIE_USE_YES=1`; without a bypass,
injection is *refused* in a non-interactive shell rather than proceeding
silently.
Fetching and executing an external script directly from a raw URL is a classic supply-chain risk. Because the script executes immediately, any compromise of the source or update path yields arbitrary code execution with the user's privileges.
NOT fall back to other tools:
curl -fsSL https://raw.githubusercontent.com/leeguooooo/cookie-use/main/install.sh | sh
cookie-use requires chrome-use on PATH. If that's missing too:
The same remote-script execution pattern is repeated for the dependency tool, multiplying supply-chain exposure. Chaining trust in two separate raw install scripts broadens the attack surface and increases the likelihood of host compromise.
cookie-use requires chrome-use on PATH. If that's missing too:
curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh
macOS only (uses the Keychain for the vault key and chrome-use's macOS cookie