dogfood

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs the agent to request/receive credentials (email, password, OTP) and insert them verbatim into agent-browser commands (e.g., fill "{PASSWORD}"), which forces the LLM to handle secret values in its output and creates a high exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill uses agent-browser --session {SESSION} open {TARGET_URL} and then repeatedly takes snapshot/screenshot/errors/console while exploring; the page content loaded from the user-supplied Target URL (public web app or arbitrary URL) is outsider-authored and becomes LLM-readable via the browser’s extracted page text/DOM for analysis.