browser-automation-notte

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill’s runtime workflow can fetch and scrape arbitrary public web pages (e.g., via the /scrape endpoint with a user-supplied url and via session page scraping/observation), and that scraped page text is then ingested into the agent/LLM context, creating an indirect prompt-injection path from outsider-authored web content.