auto-browser

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow uses the MCP browser.* tools (e.g., browser.observe, browser.get_html, browser.screenshot) to navigate to and read arbitrary websites/pages, so outsider-authored free text from those fetched pages is ingested into the agent’s LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's setup explicitly fetches and executes remote code required to run the service (e.g., "curl -fsSL https://get.docker.com | sudo sh" and "git clone https://github.com/LvcidPsyche/auto-browser.git" followed by "docker compose up --build"), so external URLs are used at install/runtime to run remote code the skill depends on.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The prompt includes explicit sudo commands that install software, modify user groups, and run systemctl (e.g., curl | sudo sh, sudo usermod -aG docker, sudo systemctl enable --now docker), which require elevated privileges and change the host system state.