agent-browser

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes explicit examples that place passwords/API credentials directly into commands (e.g., agent-browser fill @e2 "password123") and workflows that save/load auth state or suggest substituting $PASSWORD, which would require the LLM to emit secret values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill explicitly instructs the agent to open arbitrary web URLs and ingest page content (e.g., SKILL.md "Navigate: agent-browser open " and templates/capture-workflow.sh and form-automation.sh which call agent-browser open, snapshot -i, and get text body), meaning it fetches untrusted public pages and uses their content (refs/text) to drive clicks, fills, and other actions that can materially influence behavior.