browser-harness

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). One URL is a direct link to a shell script (curl | sh) on a small/custom domain, which is a high-risk pattern for delivering malware; the other URLs are documentation, a GitHub repo, localhost debugging endpoint, social page and example.com which are not themselves download vectors.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill explicitly documents connecting to and controlling a user's real browser/session, extracting login-protected content (writing it to disk), and syncing local profiles to a cloud endpoint via curl|sh, which provides clear capabilities for credential theft, data exfiltration, and remote access misuse.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). SKILL.md instructs the agent to navigate to arbitrary URLs in the user’s real browser and then read page content via js(...)/page_info() (e.g., new_tab("https://x.com/...") then js(...innerText...)), which can include outsider-authored free text from the visited web pages into the LLM context.