agent-browser

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow is browser automation that can ingest page-derived accessibility tree/text (e.g., via agent-browser snapshot / --json in agent mode), which is outsider-authored free text from arbitrary websites the user navigates to at runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes a runtime curl command that downloads a remote SKILL.md which would be loaded into an agent's skills directory and thus directly injects external instructions into agent behavior: https://raw.githubusercontent.com/vercel-labs/agent-browser/main/skills/agent-browser/SKILL.md