core

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs include personal GitHub repositories and a direct raw-install shell script (raw.githubusercontent.com/…/install.sh) — direct script downloads and tooling distributed from personal repos are common malware vectors unless the author and artifacts are verified.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This skillpack intentionally exposes powerful browser-control and local-host interfaces (cross-frame DOM access including input values, arbitrary JS eval in pages, native-messaging extension + auto-connect, state files with plaintext auth tokens, network request interception, and a local WebSocket/stream) that enable data exfiltration and remote control if misused or installed on an untrusted machine.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow involves chrome-use snapshot -i / get text reading the target web page’s accessibility tree and text (outsider-authored content from whatever URL the user opens) into the agent-visible LLM context as prose-like snapshot lines.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). chrome-use auto-fetches and runs the bb-sites adapter pack at https://github.com/epiral/bb-sites (site adapters are remote JS functions fetched at runtime and executed inside the page/tab), so this is a runtime fetch that executes remote code.