qa-engineer

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.90). The prompt includes a Midscene "Deep Think" example that explicitly instructs the agent to find the settings > "API Keys" tab and "copy the first key", which is a direct instruction to access/exfiltrate secrets and is outside the QA testing purpose, so it constitutes a prompt-injection risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's Phase 0 explicitly instructs the agent to "open the target URL (or localhost) in browser" to probe sites and Phase 5c (Midscene) and 5b (Playwright) require running vision/NLP-driven interactions (ai(), aiQuery(), aiAssert()) against page screenshots and UI — i.e., the agent fetches and ingests content from arbitrary target URLs (including third‑party/public sites) and interprets that untrusted content to drive automated actions, so indirect prompt injection is possible.