browser-control

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). At runtime, the skill reads outsider-authored page text/DOM from the user’s real Chrome session via AppleScript//eval (e.g., document.body.innerText / DOM-to-Markdown extraction in modules/dom-extraction.md and modules/applescript-commands.md, and CDP /eval in modules/cdp-proxy-api.md), which then gets fed into the agent’s LLM context as extracted content.