browser-debug-toolkit

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). At runtime the skill can delegate to the external web-access CDP Proxy channel, where it POSTs to endpoints like /eval and /screenshot against a user/browser target (e.g., web-access’s eval reads document.title/DOM text), meaning outsider-authored page text from an arbitrary provided URL can be ingested into the agent’s browser-inspection loop.