browserless

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill requires the agent to accept a user-provided Browserless token/endpoint and immediately run a command like node scripts/browserless.mjs config add --name NAME --url URL --token TOKEN, which forces the LLM to include the secret token verbatim in generated commands/outputs (and potentially logs), creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider free text can be ingested into the agent’s LLM context via the debug workflow: Browserless loads a user-supplied public page (--url-page), then returns page.page.textSample and page.page.interactiveElements (derived from the page’s DOM text) in the JSON output that the agent will read/consume.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill at runtime calls the configured Browserless base URL (for example the example target https://jiaknama-nepal-east-city-education-project.hf.space) and POSTs JavaScript to endpoints like /function (and /scrape, /debug) so the remote service executes code and is a required runtime dependency.