browsing-as-you

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Although many entries are legitimate (github.com, docs.google.com, dash.cloudflare.com, apple.com), the list contains GitHub user-attachments/files URLs (which host arbitrary uploaded binaries), generic file URLs, an explicit test/malicious domain (evil.test), and raw/local debug endpoints (127.0.0.1:9222 / {host}:{port}) and placeholders — all of which are common vectors or indicators for hosting/serving unknown executables, so the collection should be treated as suspicious.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). At runtime, the cdp.py probe / cdp.py open / cdp.py eval flow injects and reads outsider-authored free text from arbitrary web pages (e.g., cdp.py probe <url> opens a user-supplied URL and then Runtime.evaluate returns document.body.innerText / DOM-derived strings into the agent’s tool output, which the agent can place into LLM context).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The docs and .mcp.json instruct running "npx -y chrome-devtools-mcp@latest --browser-url=..." (and similar npx invocations in Codex/Gemini snippets), which fetches and executes remote npm package code (chrome-devtools-mcp@latest) at runtime and is a required dependency for the MCP browser driver.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). This skill explicitly instructs the agent to autonomously start/stop a persistent background Chrome bridge, read and inject cookies from the user's real profile, perform a one-time "login" that writes durable keys into a bridge profile, and enable autostart via launchd/systemd — all actions that modify the machine's state and create persistent services, so it poses a high risk of compromising the host.