browser-mcp-control

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow uses the browser MCP tools (e.g., browser_navigate to arbitrary user-specified URLs and browser_snapshot/browser_screenshot to extract page content), so any outsider-authored web page text loaded at runtime can be ingested into the agent’s LLM context via the tool outputs (notably the ARIA/accessibility snapshot as readable prose/structure).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The instructions require fetching and running remote executable code (git clone https://github.com/BrowserMCP/mcp.git followed by npm build/run) and installing the Browser MCP extension from https://browsermcp.io, both of which supply code that will be executed locally and are required dependencies.