browser-execute

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill grants a long-lived CDP session with arbitrary JS evaluation in real user browser profiles, persistent workspace scripts, and access to environment-provided endpoints/keys — enabling easy credential theft, data exfiltration, and remote control/backdoor behavior if abused.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill’s browser_execute drives a live browser session and can navigate to arbitrary runtime-supplied URLs (e.g., via session.Page.navigate({url})), causing the page’s fetched text/content to be read by session.Runtime.evaluate(...)—an outsider-authored free-text source (public web content) that can be used for indirect prompt injection.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly performs a runtime fetch to https://api.browser-use.com/api/v3/browsers (and related browser-use endpoints) and uses the returned cdpUrl/webSocketDebuggerUrl to connect a CDP session, which enables the agent to execute JavaScript in that remote browser—i.e., remote content directly controls where and what code is executed.