xss-dom

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs the agent to discover, save, and report new credentials/tokens (e.g., cookies, localStorage, tokens, and evidence files) which requires including secret values verbatim in outputs/evidence, creating high exfiltration risk.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). Yes — the list contains attacker-controlled exfiltration endpoints (URLs with ATTACKER and query params like ?flag=, ?c=, ?ls=), a typosquatted-looking host (trusted.com.attacker.com), and an external GitHub repo referenced for installing an extension (potentially untrusted), all of which are high-risk indicators for malware or data-exfiltration delivery.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The document is an explicit exploitation guide for DOM-based XSS that includes ready-to-use payloads and examples for remote JavaScript execution (eval/Function), credential/data exfiltration to attacker-controlled endpoints, postMessage abuse, and other attacker-controlled sinks — indicating clear malicious intent and high abuse risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill’s runtime workflow uses browser_open/browser_navigate to load attacker-controlled URLs/fragments and then browser_evaluate to trace source-to-sink flows; this causes attacker-supplied free text (e.g., #payload or crafted query params) to be read by the page’s client-side JS and placed into the LLM-visible DOM/console/evidence context.