web-access

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt requires preserving and passing full URLs (including session-related query parameters/tokens) via curl POST bodies and examples, which forces the agent to emit those sensitive token values verbatim in generated commands/requests.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill intentionally exposes powerful local browser control and local-data access—allowing arbitrary JS execution in logged-in pages, reading bookmarks/history, automated file uploads, and includes anti-detection code (intercepting debug-port probes)—which are high-risk capabilities for data exfiltration and covert remote control.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). 该 skill 的运行时 LLM 上下文暴露主要来自浏览器 CDP 的 /eval//click 等接口返回的页面文字/DOM 结果；这些内容可能包含“站点/页面作者”的自由文本（外部来源），从而被注入到 agent 的 LLM 上下文。