browser-automation

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill explicitly instructs the agent to perform browser_fill_form with username and password (and to read credentials from ~/.claude/.env or ask the user), which implies the model must supply secret values verbatim into action parameters or outputs, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). SKILL.md describes runtime “browser_snapshot → markdown extraction” / “browser_snapshot → extract data” after navigating to a target URL, which means the LLM ingests outsider-authored free text from arbitrary web pages (public web content fetched at runtime) into the agent context.