debug-browser-session

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s required runtime workflow reads untrusted free text generated by the monitored browser session (e.g., page URLs, console errors/exceptions, network response metadata/bodies when using -o json, and log contents) via kernel browsers playwright execute, kernel browsers telemetry events, kernel browsers logs stream, and kernel browsers fs read-file for the session’s VM artifacts.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). The skill instructs the agent to perform state-changing operations on session VMs (create/update/delete sessions, mutate routing, and execute commands inside the VM) which can modify machine state even though it does not request sudo or system-wide config edits.