setup-browser-cookies

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 1.00). The skill contains extensive unrelated instructions (telemetry/telemetry prompts, artifact sync/publishing, repo edits like appending/committing CLAUDE.md, vendoring migration, and other config changes) that instruct the agent to perform actions outside and beyond the stated cookie-import purpose, effectively sneaking in behavior that can exfiltrate or modify project data.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's setup step fetches and executes the Bun installer at runtime from https://bun.sh/install (downloaded with curl to a tempfile and run with bash) to satisfy a required build dependency, so remote code is executed during skill runtime.