osascript-chrome

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill's commands explicitly read and return sensitive values (document.cookie, localStorage/sessionStorage keys like "auth_token") and even show passing a password as a CLI argument ("secret"), which requires the agent to handle and potentially output secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The collection contains high-risk tooling that explicitly reads sensitive Chrome profile data (cookies, localStorage/sessionStorage, history, downloads, bookmarks, extensions, account info) and can execute arbitrary JavaScript inside any tab and auto-submit forms — capabilities that directly enable credential theft and data exfiltration even though no outbound network exfiltration is hard-coded.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider free text is ingested into the LLM context via the script’s own stdout/JSON results (e.g., scraped page text/DOM content from arbitrary websites in scripts/scrape-page.py / read-tab.py / scrape-links.py), which the runtime agent would then pass into the LLM; this is public web content authored by outsiders.