agent-browser

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes examples and commands that pass API keys, passwords, and cookies as literal CLI arguments or fill commands (e.g., BROWSERLESS_API_KEY="token", agent-browser set credentials user pass, agent-browser fill @e2 "password123", cookies set --curl), which would require an LLM to embed secret values verbatim in generated commands or code.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow includes agent-browser read <url> / open <url> which fetches arbitrary public web page content at runtime and converts it to “agent-readable text” (markdown/DOM text) that is then fed into the agent’s LLM context, enabling indirect prompt injection via page-authored free text.