Passo - Remote Browser Access

Enables secure remote access to a browser on your server for manual tasks like logins, 2FA, and captchas via a protected URL.

This skill is coherent with its stated purpose but carries real risk. Before installing: (1) inspect the install.sh contents (do not run curl | bash without review); (2) test in an isolated VM or disposable server, not a production host; (3) confirm the legitimacy and privacy policy of getpasso.app and what data it stores and shares; (4) assume any remote user with access can view cookies, sessions, and 2FA flows — only grant access to trusted people and revoke immediately after use; (5) prefer a self‑hosted or audited installer, and consider alternatives that don't expose a full browser session to third parties.

Type: OpenClaw Skill Name: passo Version: 1.0.0 The skill is suspicious due to the installation method specified in `SKILL.md`. It instructs the agent to execute an external script directly via `curl -fsSL ... | bash` from `https://raw.githubusercontent.com/felipegoulu/passo-client/main/install.sh`. This constitutes a critical remote code execution (RCE) vulnerability and a direct prompt injection against the agent, as it allows arbitrary, unreviewed code from an untrusted external source to be executed on the host system. While the stated purpose of 'Remote Browser Access' is not inherently malicious, this installation method poses a significant supply chain risk and could lead to data exfiltration, persistence, or other harmful actions if the external script were compromised or designed with malicious intent.