agent-browser

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill includes examples that embed plaintext credentials directly into generated CLI commands (e.g., fill "password123" and echo "pass") and states session tokens are stored in plaintext, which would require an LLM to handle or emit secret values verbatim and thus presents a high exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md’s required browser automation workflow ingests arbitrary outsider-authored page text at runtime via agent-browser open <url> followed by agent-browser snapshot -i (and optionally agent-browser get text body), so a user can navigate to attacker-controlled free text without needing a specific “item selection.”