agent-browser

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). At runtime, the skill’s open/goto/navigate commands fetch arbitrary web pages (outsider-authored content) and snapshot --json ingests the resulting accessibility tree/text into the agent context, enabling indirect prompt injection via page content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). I flag the raw GitHub URL https://raw.githubusercontent.com/vercel-labs/agent-browser/main/skills/agent-browser/SKILL.md because the examples include a curl command that downloads that SKILL.md into a .claude/skills directory at runtime (directly injecting instructions the agent will use); the docs also show git clone https://github.com/vercel-labs/agent-browser.git plus build/install steps which fetch remote code and execute it during setup.

MEDIUM W021: Hidden or invisible Unicode characters detected (potential obfuscation or prompt injection).

• Hidden Unicode characters detected (1 type(s) found)