kernel-browser-harness

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill takes the runtime CDP WebSocket URL returned by kernel browsers create (the JWT-signed wss://... value from the cdp_ws_url field) and injects it into BU_CDP_WS so browser-harness connects to that external wss:// endpoint and executes commands in the remote browser, i.e., it relies on a runtime external URL that executes remote code.