browser-automation

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes explicit examples and instructions to perform automated logins by filling password fields (e.g., browser(... "text":"mypassword")), which requires the agent to insert secret credentials verbatim into generated tool calls and outputs, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly instructs the agent to navigate to arbitrary external URLs and ingest page content (e.g., browser(action="navigate", targetUrl="...") and browser(action="snapshot"/"act" with "evaluate") in the "Agent Tool Reference" and "Common Patterns & Recipes" sections), and then read/interpret that DOM/text to decide clicks/fills and next actions, so untrusted third‑party web content can materially influence behavior.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs bypassing security (set "noSandbox": true) and contains sudo-level system modifications (e.g., sudo snap remove, sudo dpkg -i, sudo update-ca-certificates), so it encourages actions that change and weaken the host system state.