chrome-automation

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill intentionally navigates to arbitrary web URLs (e.g., chrome-a11y navigate "url", launch/start scripts that accept a URL) and inspects the Chrome accessibility tree (chrome-a11y and chrome-monitor) to read element names/descriptions and auto-click/watch elements, so untrusted third-party web content can be ingested and directly influence automated actions.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). This skill explicitly instructs bypassing Chrome's sandbox via --no-sandbox and includes destructive process commands (pkill -9), effectively encouraging disabling security mechanisms and modifying system state.