chrome

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Outsider free text can enter the LLM context via CDP Runtime.evaluate/DOMSnapshot.captureSnapshot/Network.getResponseBody results, which are page-authored content from whatever URL the user’s Chrome tab is on (public web content or other third-party text) and are returned as readable JSON/text to the agent.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). The skill routinely copies and executes scripts on a remote host via SSH and explicitly uses PowerShell's "-ExecutionPolicy Bypass" (a security-policy bypass), which allows arbitrary code execution on the user's machine even without sudo and thus presents a meaningful risk to the machine's state.