autoglm-browser-agent

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's SKILL.md explicitly directs the agent to open and scrape arbitrary public websites and social media (e.g., "打开网页…浏览社交媒体(微博/小红书/知乎/抖音/B站)" and via the browser_subagent start_url/task workflow), meaning it ingests untrusted, user-generated third‑party content and uses that content to drive automated actions and decisions.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). The skill instructs actions that alter the host state (removing macOS com.apple.quarantine to “解除安全限制”, starting a background relay process, and writing persistent config/session files), which constitutes bypassing a security mechanism and persisting modifications even though it does not request sudo or create users.