webmcp-chrome-devtools-quickstart

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill’s runtime workflow can ingest outsider-authored free text from arbitrary web pages because the Chrome DevTools MCP tools (e.g., navigate_page, evaluate_script, list_webmcp_tools, call_webmcp_tool) operate on the currently loaded page and return page-derived text (like DOM content / tool descriptions) into the agent’s LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs running remote code at runtime—e.g. "npx @mcp-b/chrome-devtools-mcp@latest" and adding the MCP URL "https://docs.mcp-b.ai/mcp", and it also includes a git clone of "https://github.com/WebMCP-org/chrome-devtools-quickstart.git" and npm-installed package "@mcp-b/global"—all of which fetch and execute external code that the skill relies on to operate.