agent-browser

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill includes examples that embed plaintext passwords directly into CLI commands (e.g., agent-browser fill "password123" and chained commands), which would require an LLM to output secret values verbatim and thus poses an exfiltration risk.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). One URL (https://malicious.com) is an explicitly untrusted domain in the list and is a clear high-risk indicator for malicious downloads or distribution.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The docs expose several intentional, high-risk capabilities — arbitrary JS eval (including base64-encoded payloads), file:// local-file access, network request interception, session/state files containing auth tokens, proxy/rotation support for anonymity, and an explicit bypass where "auth vault" operations circumvent the action policy — all of which enable data exfiltration and policy-evading credential access if misused.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Yes—this workflow uses agent-browser snapshot -i (and related get text body/snapshot outputs) which ingests page-sourced accessibility/text content from a runtime URL into the agent’s LLM context, creating an indirect prompt-injection path from outsider-authored web content.