browser-cdp

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs the agent to eval localStorage.getItem("token") || document.cookie to extract auth tokens/cookies, which requires the LLM to read and output sensitive credential values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). 该 skill 在运行时会先复用/启动本机 Chrome 的 CDP 并随后通过 agent-browser --cdp 9222 open "<URL>"、eval 'document.body.innerText...' 等读取“所访问页面”的正文文本；因此如果攻击者能影响传入的 URL/要打开的页面内容，就会把外部（可能由外部作者撰写的）自由文本注入到 LLM 上下文。

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill explicitly instructs the agent to kill users' Chrome processes, delete/reset the debug profile (~ /chrome-debug-profile), and run a setup script that can alter system state (including force-killing by executable name), so it pushes the agent to perform destructive system actions unless the user consents.