dogfood

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs the agent to prompt for and insert user credentials (e.g., "{EMAIL}", "{PASSWORD}", OTP codes) verbatim into chrome-use fill commands and then save session state, which requires the LLM to handle and output secrets directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). SKILL.md’s required workflow uses chrome-use --session {SESSION} snapshot / screenshot / errors / console during exploration, which necessarily reads the target web app’s rendered page content and console output at runtime; if the target URL is outsider-controlled, that page text/console output can include attacker-supplied free text that may be ingested into the agent’s LLM context (indirect prompt injection risk).