open-gstack-browser

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill’s runtime workflow includes browsing public web pages (e.g., Step 4 runs $B goto https://news.ycombinator.com and then $B snapshot -i), which causes outsider-authored page content to be read/ingested by the browser/side-panel agent and thus fed into the LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The setup step downloads and then executes a remote installer from https://bun.sh/install (curl -fsSL "https://bun.sh/install" -o "$tmpfile" followed by BUN_VERSION="..." bash "$tmpfile"), which fetches and runs remote code at runtime and is required for the skill setup.