browse

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill’s runtime workflow can fetch and ingest public web content via the browse tool (e.g., goto <url> / download <url> / text / snapshot), which then becomes readable page text wrapped as “UNTRUSTED EXTERNAL CONTENT” and may be included in the agent’s LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The setup step conditionally downloads and then executes a remote install script via curl -fsSL "https://bun.sh/install" and runs it with bash (even though a checksum is checked), which is a runtime fetch that executes remote code.