DataHive Installer

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:58 AM UTC
• Version: 0.1.0

Overview

This skill performs the advertised DataHive login flow, but it also makes persistent, privileged browser changes and handles login tokens in ways that need careful review.

Install only if you are comfortable granting this skill administrative installation authority, persistent Chrome control, Gmail lookup access, and managed browser-policy changes. Prefer a version that avoids forced extensions, validates URLs, redacts magic links, keeps Chrome sandboxed, and includes cleanup or rollback steps.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (7)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/1_install_prerequisites.sh:49

Finding

Persistent Force-Installation of a Remotely Mutable Chrome Extension

Content

View full analysis

[ubuntu] Force-installing DataHive extension via Chrome policy..." sudo mkdir -p /etc/opt/chrome/policies/managed sudo tee /etc/opt/chrome/policies/managed/extensions.json > /dev/null << EOF { "ExtensionInstallForcelist": [ "${EXTENSION_ID};https://clients2.google.com/service/update2/crx" ] } EOF ``` ```bash echo "==> [macos] Applying managed extension policy (requires sudo)..." POLICY_DIR="/Library/Managed Preferences" POLICY_FILE="$POLICY_DIR/com.google.Chrome.plist" POLICY_VALUE="${EXTENSION_ID};https://clients2.google.com/service/update2/crx" sudo mkdir -p "$POLICY_DIR" sudo /usr/libexec/PlistBuddy -c "Delete :ExtensionInstallForcelist" "$POLICY_FILE" 2>/dev/null || true sudo /usr/libexec/PlistBuddy -c "Add :ExtensionInstallForcelist array" "$POLICY_FILE" sudo /usr/libexec/PlistBuddy -c "Add :ExtensionInstallForcelist:0 string $POLICY_VALUE" "$POLICY_FILE" sudo plutil -lint "$POLICY_FILE" >/dev/null ``` ### Technical Analysis The installer uses administrator privileges to create a managed Chrome policy that force-installs extension `bonfdkhbkkdoipfojcnimjagphdnfedb`. The extension is downloaded from an external update service, but its source code, permissions, version, and integrity metadata are absent from the audited project. Consequently, the effective browser code can change after this Skill has been reviewed. Managed force-installed extensions generally cannot be disabled by an ordinary user and remain installed across browser and system sessions. The documented magic-link workflow only requires an HTTP request, email retrieval, and CDP navigation; it does not establish why a system-wide forced extension is necessary. On macOS, ...[truncated 1381 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/2_launch_chrome_supervisor.sh:76

Finding

Arbitrary Shell Command Execution Through eval and Environment-Controlled Paths

Content

View full analysis

&2 exit 1 fi CHROME_CMD="\"$CHROME_BIN\" --no-first-run --disable-default-apps --disable-gpu $NO_SANDBOX_FLAG $HEADLESS_FLAG --remote-debugging-port=9222 --user-data-dir=\"$PROFILE_DIR\" --profile-directory=datahive" fi SUPERVISOR_SCRIPT='set -u while true; do eval "$CHROME_CMD" ``` ### Technical Analysis The script constructs a shell command as a string and executes it with `eval`. `PROFILE_DIR` is accepted from the process environment and interpolated into that command string. Although the value is surrounded by literal double quotes, a crafted value can include a double quote followed by shell syntax, terminate the intended argument, and introduce additional commands. Using `eval` causes the shell to parse the generated content a second time. This converts data originating from environment variables into executable shell syntax. ### Attack Path 1. An attacker gains influence over the environment used to invoke the Skill, including `PROFILE_DIR`. 2. The attacker supplies a value containing quote characters and shell metacharacters. 3. The script embeds the value into `CHROME_CMD`. 4. The supervisor invokes `e ...[truncated 767 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/2_launch_chrome_supervisor.sh:75

Finding

Chrome Sandbox Disabled Unconditionally on Ubuntu

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/6_open_magic_link.sh:3

Finding

Magic Authentication Token Disclosed in Process Environment and Output

Content

View full analysis

' ./scripts/6_open_magic_link.sh ``` ### Technical Analysis The complete magic-link URL contains a short-lived bearer-style authentication token. The helper requires that URL in an environment variable and then prints it verbatim. The token can consequently enter terminal history, agent transcripts, CI logs, process diagnostics, monitoring output, or other command-output capture systems. Although the documentation warns that magic links are secrets, the implementation contradicts that guidance by logging the secret. ### Attack Path 1. The Skill retrieves a valid DataHive magic link from Gmail. 2. The complete URL is assigned to `TARGET_URL`. 3. The helper navigates Chrome to the URL. 4. The helper prints `Opened `, including the token. 5. An observer with access to the transcript, terminal output, or captured logs retrieves the link. 6. The observer opens the link before expiration and attempts to authenticate as the intended user. ### Impact Assessment Disclosure can permit unauthorized DataHive authentication during the link's validity period, documented as approximately 15 minutes. The resulting account privileges are those granted by DataHive to the affected email account. The exposure is limited by token expiration and any server-side one-time-use enforcement, but neither should be relied upon ...[truncated 45 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/6_open_magic_link.sh:3

Finding

Unvalidated CDP and Navigation URLs with Unsafe JSON Construction

Content

View full analysis

/dev/null || { echo "Error: Chrome DevTools endpoint is unavailable at $CDP_URL (is Chrome running with --remote-debugging-port=9222?)" >&2 exit 1 } NEW_TAB=$(curl -sf -X PUT "$CDP_URL/json/new") || { echo "Error: failed to create tab at $CDP_URL" >&2 exit 1 } WS_URL=$(echo "$NEW_TAB" | grep '"webSocketDebuggerUrl"' | cut -d'"' -f4) RESPONSE=$(websocat -n1 "$WS_URL" <<< "{\"id\":1,\"method\":\"Page.navigate\",\"params\":{\"url\":\"$TARGET_URL\"}}") ``` ### Technical Analysis The script does not verify that `TARGET_URL` uses HTTPS, belongs to `dashboard.datahive.ai`, and targets the expected `/auth` route. It will attempt to navigate to any value provided through the environment. The value is also inserted directly into a JSON string without JSON escaping. Quotes, backslashes, or control characters can make the message malformed or alter its structure. Similarly, `CDP_URL` is environment-controlled and is not restricted to a loopback endpoint. The helper can therefore send HTTP requests to an arbitrary host and connect to a WebSocket URL returned by that host. ### Attack Path 1. An attacker influences the extracted URL or the environment supplied to the helper. 2. The attacker sets `TARGET_URL` to an unintended destination or includes JSON metacharacters. 3. The helper creates a new browser tab and sends the constructed CDP message. 4. Chrome navigates to an attacker-selected URL, or the crafted value changes the CDP request structure. 5. Alternatively, the attacker changes `CDP_URL` to an external service. 6. The helper contacts that service and trusts its returned `webSocketDebuggerUrl`. 7. The at ...[truncated 602 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/4_request_magic_link.sh:4

Finding

Email Address Embedded in JSON Without Validation or Escaping

Content

View full analysis

(or set EMAIL=...)" >&2; exit 1; } curl -sS 'https://api.datahive.ai/api/auth/magic-link/request' \ -H 'content-type: application/json' \ --data-raw "{\"email\":\"$EMAIL\",\"redirectUrl\":\"https://dashboard.datahive.ai/auth\"}" ``` ### Technical Analysis The email value is directly interpolated into a JSON string. The script only checks that it is nonempty. A value containing a double quote, backslash, newline, or other JSON metacharacter can invalidate the body or introduce additional JSON fields. Normal email addresses obtained from a trusted `gog` account are unlikely to contain such syntax. Nevertheless, the helper also accepts an arbitrary command-line argument or environment variable, so it should treat the value as untrusted data. Transmission of the email to `https://api.datahive.ai` is disclosed by the Skill and is functionally necessary to request the magic link; the vulnerability is the unsafe encoding, not the declared transmission itself. ### Attack Path 1. An attacker or calling process controls the argument or `EMAIL` environment variable. 2. A crafted value containing JSON syntax is supplied. 3. The helper interpolates it into the request body without escaping. 4. DataHive receives malformed JSON or a request whose object structure differs from the intended structure. 5. Depending on server validation, this may cause request failure or manipulation of accepted request fields. ### Impact Assessment The likely impact is denial of the login request or incorrect request semantics. If the server accepts attacker-introduced fields, request behavior could potentially be modified within the constraints of the endpoint. There is no evidence in the audited co ...[truncated 90 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/1_install_prerequisites.sh:74

Finding

Recursive Removal of macOS Quarantine Metadata from Chrome

Content

View full analysis

[macos] Removing quarantine attribute from Google Chrome (if present)..." xattr -dr com.apple.quarantine "/Applications/Google Chrome.app" 2>/dev/null || true ``` ### Technical Analysis The script recursively removes the `com.apple.quarantine` extended attribute from the complete Chrome application bundle. Quarantine metadata participates in macOS Gatekeeper checks and user-facing trust decisions for downloaded software. The command is executed without confirming the bundle's provenance, code signature, notarization state, or installation source. Removing quarantine is not required by the declared DataHive magic-link workflow and suppresses errors through `|| true`, preventing the operator from seeing whether this security-sensitive operation failed. ### Attack Path 1. A Chrome bundle exists at the expected path, but it has been replaced, modified, or downloaded from an untrusted source. 2. The operator runs the prerequisite script. 3. The script recursively removes quarantine metadata from that bundle. 4. The later supervisor starts the application. 5. Security prompts or checks associated with quarantine metadata may no longer occur as expected. 6. A tampered application can execute with the privileges of the user launching Chrome. ### Impact Assessment This weakens a macOS security control for the entire Chrome bundle. If the application has been tampered with, execution could compromise all data and resources accessible to the invoking user, including the isolated browser profile and magic-link authentication token. The command does not itself modify code signatures or automatically grant root privileges, but it unnecessarily reduces protection against untrusted application bundles. ]]>

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (47)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is advertised as DataHive-specific login automation, but parts of the behavior are generic URL opening and browser control without clear verification that only trusted DataHive endpoints are used. Generic browser automation combined with token-bearing URLs can be abused to open attacker-controlled links or mishandle secrets.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is advertised as DataHive-specific login automation, but parts of the behavior are generic URL opening and browser control without clear verification that only trusted DataHive endpoints are used. Generic browser automation combined with token-bearing URLs can be abused to open attacker-controlled links or mishandle secrets.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill is advertised as DataHive-specific login automation, but parts of the behavior are generic URL opening and browser control without clear verification that only trusted DataHive endpoints are used. Generic browser automation combined with token-bearing URLs can be abused to open attacker-controlled links or mishandle secrets.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill is advertised as DataHive-specific login automation, but parts of the behavior are generic URL opening and browser control without clear verification that only trusted DataHive endpoints are used. Generic browser automation combined with token-bearing URLs can be abused to open attacker-controlled links or mishandle secrets.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill is advertised as DataHive-specific login automation, but parts of the behavior are generic URL opening and browser control without clear verification that only trusted DataHive endpoints are used. Generic browser automation combined with token-bearing URLs can be abused to open attacker-controlled links or mishandle secrets.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md

Always execute this skill in the exact sequence defined in **strict order**, exactly as written in this `SKILL.md`.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/1_install_prerequisites.sh (reported line 42)May include surrounding context.

sh

echo "==> [ubuntu] Installing Google Chrome + runtime deps..."
  sudo apt-get update
  sudo apt-get install -y --no-install-recommends wget gnupg2 xvfb
  wget -qO- https://dl.google.com/linux/linux_signing_key.pub | sudo gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg
  echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" | \
    sudo tee /etc/apt/sources.list.d/google-chrome.list > /dev/null
  sudo apt-get update

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/1_install_prerequisites.sh (reported line 43)May include surrounding context.

sh

echo "==> [ubuntu] Installing Google Chrome + runtime deps..."
  sudo apt-get update
  sudo apt-get install -y --no-install-recommends wget gnupg2 xvfb
  wget -qO- https://dl.google.com/linux/linux_signing_key.pub | sudo gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg
  echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" | \
    sudo tee /etc/apt/sources.list.d/google-chrome.list > /dev/null
  sudo apt-get update

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/1_install_prerequisites.sh (reported line 42)May include surrounding context.

sh

echo "==> [ubuntu] Installing Google Chrome + runtime deps..."
  sudo apt-get update
  sudo apt-get install -y --no-install-recommends wget gnupg2 xvfb
  wget -qO- https://dl.google.com/linux/linux_signing_key.pub | sudo gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg
  echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" | \
    sudo tee /etc/apt/sources.list.d/google-chrome.list > /dev/null
  sudo apt-get update

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/1_install_prerequisites.sh (reported line 47)May include surrounding context.

sh

sudo tee /etc/apt/sources.list.d/google-chrome.list > /dev/null
  sudo apt-get update
  sudo apt-get install -y --no-install-recommends google-chrome-stable
  sudo rm -rf /var/lib/apt/lists/*

  echo "==> [ubuntu] Force-installing DataHive extension via Chrome policy..."
  sudo mkdir -p /etc/opt/chrome/policies/managed

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/1_install_prerequisites.sh (reported line 47)May include surrounding context.

sh

sudo tee /etc/apt/sources.list.d/google-chrome.list > /dev/null
  sudo apt-get update
  sudo apt-get install -y --no-install-recommends google-chrome-stable
  sudo rm -rf /var/lib/apt/lists/*

  echo "==> [ubuntu] Force-installing DataHive extension via Chrome policy..."
  sudo mkdir -p /etc/opt/chrome/policies/managed

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill invokes shell commands, package installation, browser launch, Gmail access, and CDP interactions but declares no explicit tool scope or permission boundaries. That makes the effective authority of the skill opaque and increases the chance an agent executes high-risk actions without informed consent or policy enforcement.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest frames the skill as sign-in automation, but the body instructs installation of system packages and browser policy changes. This scope drift is dangerous because it weakens informed consent and can conceal invasive persistence or policy modifications behind a benign description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs searching and retrieving Gmail messages through gog but does not present an explicit up-front warning that it will access mailbox content. Email contains highly sensitive data, and magic-link workflows expose authentication tokens that should only be handled with informed user consent and minimal retention.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill does not clearly warn users that it will install software and write managed Chrome policy settings, including privileged system locations. Silent host modification is risky because it can change browser behavior persistently and create administrative trust anchors without the operator's informed approval.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The inline text explicitly says the skill is limited to authentication automation, yet the steps include host installation and configuration. Contradictory safety framing can cause users or orchestrators to trust the skill more than warranted and execute privileged changes without scrutiny.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The skill describes persistent background browser operation and managed policy configuration, which creates session persistence beyond the immediate task. Persistent authenticated browser state and always-on CDP access increase the window for token theft, unauthorized browser control, and cross-session abuse.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md

Behavior by platform:
- `ubuntu`: installs Chrome + xvfb via `apt`, applies managed extension policy, installs `websocat`.
- `macos`: installs Chrome via Homebrew cask (if missing), applies managed extension policy in `/Library/Managed Preferences/com.google.Chrome.plist`, installs `websocat`.

## Step 2 — Launch browser in persistent background mode (platform-aware)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/1_install_prerequisites.sh (reported line 40)May include surrounding context.

sh

install_ubuntu() {
  echo "==> [ubuntu] Installing Google Chrome + runtime deps..."
  sudo apt-get update
  sudo apt-get install -y --no-install-recommends wget gnupg2 xvfb
  wget -qO- https://dl.google.com/linux/linux_signing_key.pub | sudo gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg
  echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" | \

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/1_install_prerequisites.sh (reported line 41)May include surrounding context.

sh

install_ubuntu() {
  echo "==> [ubuntu] Installing Google Chrome + runtime deps..."
  sudo apt-get update
  sudo apt-get install -y --no-install-recommends wget gnupg2 xvfb
  wget -qO- https://dl.google.com/linux/linux_signing_key.pub | sudo gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg
  echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" | \

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/1_install_prerequisites.sh (reported line 42)May include surrounding context.

sh

install_ubuntu() {
  echo "==> [ubuntu] Installing Google Chrome + runtime deps..."
  sudo apt-get update
  sudo apt-get install -y --no-install-recommends wget gnupg2 xvfb
  wget -qO- https://dl.google.com/linux/linux_signing_key.pub | sudo gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg
  echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" | \

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/1_install_prerequisites.sh (reported line 44)May include surrounding context.

sh

install_ubuntu() {
  echo "==> [ubuntu] Installing Google Chrome + runtime deps..."
  sudo apt-get update
  sudo apt-get install -y --no-install-recommends wget gnupg2 xvfb
  wget -qO- https://dl.google.com/linux/linux_signing_key.pub | sudo gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg
  echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" | \

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/1_install_prerequisites.sh (reported line 45)May include surrounding context.

sh

install_ubuntu() {
  echo "==> [ubuntu] Installing Google Chrome + runtime deps..."
  sudo apt-get update
  sudo apt-get install -y --no-install-recommends wget gnupg2 xvfb
  wget -qO- https://dl.google.com/linux/linux_signing_key.pub | sudo gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg
  echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" | \

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/1_install_prerequisites.sh (reported line 46)May include surrounding context.

sh

install_ubuntu() {
  echo "==> [ubuntu] Installing Google Chrome + runtime deps..."
  sudo apt-get update
  sudo apt-get install -y --no-install-recommends wget gnupg2 xvfb
  wget -qO- https://dl.google.com/linux/linux_signing_key.pub | sudo gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg
  echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" | \

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/1_install_prerequisites.sh (reported line 47)May include surrounding context.

sh

install_ubuntu() {
  echo "==> [ubuntu] Installing Google Chrome + runtime deps..."
  sudo apt-get update
  sudo apt-get install -y --no-install-recommends wget gnupg2 xvfb
  wget -qO- https://dl.google.com/linux/linux_signing_key.pub | sudo gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg
  echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" | \

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/1_install_prerequisites.sh (reported line 50)May include surrounding context.

sh

install_ubuntu() {
  echo "==> [ubuntu] Installing Google Chrome + runtime deps..."
  sudo apt-get update
  sudo apt-get install -y --no-install-recommends wget gnupg2 xvfb
  wget -qO- https://dl.google.com/linux/linux_signing_key.pub | sudo gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg
  echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" | \