browser-use

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The workflow instructs the agent to browse arbitrary websites and read page content, which can contain outsider-authored text (low risk browser navigation).

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill operates a browser via command-line tools (agent-browser) to perform actions on websites, including purchasing and form submission on the user's behalf. This constitutes a direct financial operation (purchases/charges). The execution layer relies entirely on user-provided browser sessions, site authentication, and agent instructions without independent, service-level access controls or validation specifically gating the financial routes.