nodriver-browser

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly shows and supports passing plaintext credentials as command-line/text arguments (e.g., scripts/type.py r2 "hunter2"), which means an agent using it would need to emit secret values verbatim in commands or scripts.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider free text is ingested into the LLM context via scripts/snapshot.py → snapshot.py reads document.body.innerText (and aria-label/alt/title/innerText from interactive elements) from the runtime-loaded page, which is outsider-authored content when the user navigates to arbitrary external URLs.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). This skill explicitly navigates to and loads arbitrary user-supplied URLs at runtime (e.g., scripts/nav.py https://example.com) and returns page text/refs (snapshot.py) and executes page JavaScript inside the persistent Chromium instance, meaning remote page content can both execute code in the browser and directly influence agent prompts/behavior.