agent-browser

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The prompt includes explicit examples that embed passwords/credentials verbatim in commands (e.g., agent-browser fill @e2 "password123") and instructions that would require the LLM to emit secret values directly, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The SKILL.md and accompanying templates explicitly direct the agent to navigate to arbitrary external URLs (agent-browser open ), take snapshots and extract page content (agent-browser snapshot -i, get text body, pdf, screenshots) and then act on that content (click/fill/etc.), so the agent will fetch and interpret untrusted, public third‑party web content as part of its workflow while security controls are opt‑in.