web-access

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to preserve and use full URLs that may contain session tokens and to embed those URLs in curl/new requests, which can force the LLM to handle and output sensitive tokens verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.78). 该 skill 在运行时会通过浏览器 CDP 打开用户指定/页面内跳转到的任意网页，并在 /eval 等端点中把页面 DOM/文本（来自外部网站内容）作为可读字符串返回给代理模型上下文；这属于“公共 web 内容/网页正文被读取并喂给 LLM”的间接提示注入风险路径。