page-agent-web-automation

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes patterns that embed actual form values into natural-language commands (e.g., autoFillForm builds "Fill with ") and also logs agent steps/results, so secrets (passwords/API keys) can be passed verbatim to the LLM and appear in outputs, creating exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md shows PageAgent runs in-page on arbitrary public web pages and explicitly uses commands like "Describe what is visible on this page", navigation and multi-page automation (browser extension examples), so the agent reads and acts on untrusted third-party DOM/content from public sites which could contain malicious instructions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes a runtime CDN script that fetches and executes remote JavaScript which implements the in-page agent and thus controls prompts/instructions: https://cdn.jsdelivr.net/npm/page-agent@1.8.2/dist/iife/page-agent.demo.js (loaded via in the "CDN (Quick Testing)" example).