agent-browser

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly opens arbitrary target URLs and ingests page content (SKILL.md required inputs + Workflow steps: "Open the target URL", "snapshot -i", and "Extracted content or next-step instructions based on snapshot evidence") and the templates (e.g., templates/capture-workflow.sh and form-automation.sh) and command docs (references/commands.md's open/get text) show it reads untrusted public web pages and uses that content to drive actions, so third-party page text could materially steer the agent.