chrome-relay

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill enables remote control of a user's real Chrome session and includes explicit, stealthy recipes to extract and persist credentials and network bodies (including a native-host install), which are high-risk capabilities for data exfiltration and covert credential theft.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow uses chrome-relay snapshot/wait to read the user’s real Chrome page (accessibility tree + page state) into the agent context, and that page content can include outsider-authored free text (e.g., any arbitrary website the user navigates to at runtime).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill requires installing and running the chrome-relay CLI and browser extension (fetching remote code during setup), referenced at https://chromewebstore.google.com/detail/chrome-relay/cpdiapbifblhlcpnmlmfpgfjlacebokb and https://www.npmjs.com/package/chrome-relay, so external content is fetched and executed as a required dependency.