claude-chrome
4 findings (2 high, 2 medium), mainly command injection, data exfiltration, unauthorized tool use. Most recent scan 2026-02-05.
This skill presents SIGNIFICANT SECURITY RISKS due to mandatory permission bypass (--dangerously-skip-permissions), unrestricted browser access, and lack of data protection controls. The combination of auto-approved actions, arbitrary website navigation, form filling capabilities, and external binary execution creates multiple attack vectors for data exfiltration, credential theft, and transitive trust abuse. The skill's description significantly understates these risks, potentially misleading users about its security implications. While the skill may have legitimate automation use cases, it requires substantial security hardening before safe deployment. Critical issues include: mandatory safety bypass, no domain restrictions, no credential protection, tool restriction circumvention, and transitive trust to arbitrary web content.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Use Claude Code with Chrome browser extension for web browsing and automation tasks. Alternative to OpenClaw's built-in browser tools.
- Package
- 1 file, 3.5 KB
- SKILL.md
- 468 words, 8 sections
- Code
- None. Instructions only.
- Requires
- anyBins:
claude
SKILL.md covers: Claude Chrome — Browser Automation via Claude Code · Prerequisites · How It Works · Step 1: Check if Chrome Extension is Active · Step 2: Run Claude Code with Chrome · Performance Benchmarks · Limitations · Tips
Findings
HIGH Dangerous Permission Bypass Flag Required for Operation Command Injectionllm
The skill mandates use of '--dangerously-skip-permissions' flag which bypasses all safety confirmations in Claude Code. This flag auto-approves all browser actions without user consent, enabling arbitrary command execution, data access, and form submissions without oversight. The instructions explicitly state this flag is 'required for automation', making dangerous operations the default behavior.
SKILL.md
--dangerously-skip-permissions — auto-approve all actions (required for automation)
Always use `--dangerously-skip-permissions` for automated runsHIGH Unrestricted Browser Access Without Data Protection Controls Data Exfiltrationllm
The skill provides unrestricted browser automation capabilities with no data protection boundaries. It can read any webpage content, access form data, extract credentials from login pages, and interact with authenticated sessions. Combined with the mandatory '--dangerously-skip-permissions' flag, this enables silent data exfiltration from any website the user has access to, including banking sites, email, cloud services, and internal corporate applications.
SKILL.md
Claude Code gains browser tools — it can navigate pages, click elements, fill forms, read content, and more.
Go to example.com and read the headlineMEDIUM Tool Restriction Bypass via External Binary Execution Unauthorized Tool Usellm
The skill bypasses agent tool restrictions by delegating all operations to an external binary (Claude Code) via nodes.run. This circumvents any allowed-tools restrictions that might be in place, as the agent only sees a bash command execution, not the actual browser automation operations. The external binary has unrestricted capabilities including network access, file system access, and arbitrary code execution through browser JavaScript.
SKILL.md
nodes.run node=<your-node-id> command='["bash", "-lc", "claude --dangerously-skip-permissions --chrome -p \"Go to example.com and read the headline\""]'MEDIUM Misleading Description Omits Security Risks Social Engineeringllm
The skill description presents this as a simple 'browser automation' alternative without disclosing the significant security implications: mandatory permission bypass, unrestricted web access, credential exposure risks, and external binary execution. Users may enable this skill thinking it's a safe browsing tool, unaware that it grants unrestricted browser control with no safety confirmations.
SKILL.md
description: Use Claude Code with Chrome browser extension for web browsing and automation tasks. Alternative to OpenClaw's built-in browser tools.
VS actual capabilities: --dangerously-skip-permissions, unrestricted form filling, credential access, arbitrary navigationWhat is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 3.5 KB |
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/claude-chrome
- Raw scan result: claude-chrome-scan.json
- Badge for your README:
- Request a re-scan