web-access

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly instructs retaining full URLs including session-related parameters (tokens) (SKILL.md:141-142), which forces the agent to include potentially sensitive session tokens or other secrets verbatim in outputs.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The code intentionally exposes powerful local-browser automation and inspection capabilities (arbitrary JS eval in page contexts, local Chrome data access, setting host filesystem files into page uploads, and stealthy DevTools hiding) that can be readily abused for credential theft or data exfiltration and include explicit evasion behavior.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 该 skill 的运行时通过 CDP Proxy 在用户浏览器中执行 /new（任意 URL）与 /navigate 并用 /eval 读取页面 DOM 文本/属性，因此“外部作者的网页自由文本”会在未先选择特定已授权来源的情况下被 LLM 直接读入。