screenshotting-apps

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Yes—during the “Live website” workflow the skill uses agent-browser open <url> and then reads page content (e.g., via agent-browser find text "Accept" click / snapshot / get text body-style operations) from an outsider-controlled public webpage, which can include attacker-supplied free text that may be incorporated into the agent’s LLM context.