T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:220
- Finding
- Unverified Remote Script Is Executed Directly by the Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 220-221 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://browser-use.com/profile.sh | \ BROWSER_USE_API_KEY=XXXX sh ``` ### Technical Analysis The documented command retrieves a shell script from an external URL and passes the response directly to `sh`. The script is not pinned to an immutable release, inspected before execution, or validated using a cryptographic signature or known digest. Consequently, the payload that executes can differ from the content available when the Skill was audited. Compromise of the remote server, domain, DNS resolution, CDN, deployment pipeline, or upstream script could turn this command into an arbitrary code-execution channel. Supplying `BROWSER_USE_API_KEY` to the new shell also makes that credential available to the downloaded script. ### Attack Path 1. An attacker compromises or gains control over `browser-use.com/profile.sh` or an infrastructure component serving it. 2. The attacker replaces the expected script with a malicious shell payload. 3. A user follows the Skill documentation and executes the command. 4. `curl` retrieves the attacker-controlled response. 5. The response is passed directly to `sh` without verification. 6. The payload runs with the privileges of the invoking user and can read the supplied API key and other user-accessible resources. ### Impact Assessment Successful exploitation permits arbitrary command execution with the invoking user's privileges. Depending on those privileges, the payload could: - Read or modify user files. - Exfiltrate the supplied Browser Use API key and other accessible credentials. - Access browser profiles and authenticated session data. - Install additional software or persistence mechanisms. - Modify Agent configuration and trusted Skill files. - Use authenticated services available to the affected account. ...[truncated 151 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove the direct `curl | sh` execution pattern. - Publish the script as a versioned, immutable release artifact. - Download the artifact to a staging location before execution. - Verify a documented SHA-256 digest or a trusted cryptographic signature. - Display or otherwise make the downloaded script available for review before execution. - Require explicit user approval after verification and before invoking the shell. - Avoid exposing the API key to the installer unless strictly necessary. - Run the script in a restricted environment with the minimum required filesystem and network access. - Document credential rotation and revocation procedures if the script or delivery infrastructure is compromised. ]]>