browse

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill exposes commands that take credentials/secrets as literal arguments (e.g., cookie =, header :, fill "...password...") and includes examples that place secrets in plain text, so an LLM using this skill would likely need to emit secret values verbatim in generated commands or code, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The browse skill explicitly navigates to arbitrary URLs and ingests page content as part of its required workflow (see SKILL.md "Core QA Patterns" and the Full Command List with commands like "goto ", "text", "html", "snapshot", "click", and "js"), so untrusted public webpages could be read/interpreted and materially influence subsequent tool actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's setup step can run a one-shot installer that executes remote code via "curl -fsSL https://bun.sh/install | bash" (invoked if bun is missing), which fetches and runs external code at runtime and is required for setup.