vision-click

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.90). The prompt explicitly includes a "--dangerously-bypass-approvals-and-sandbox" flag (and similar skip checks) which instructs the tool to disable safety/approval mechanisms and override sandboxing—an instruction to circumvent system constraints that is unnecessary for coordinate extraction and therefore a deceptive/unsafe override outside the skill's stated purpose.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The script itself is not an obvious backdoor or reverse shell, but it deliberately sends raw screenshots to an external Codex CLI with explicit sandbox/approval bypass flags (--dangerously-bypass-approvals-and-sandbox, --skip-git-repo-check), which creates a high risk of sensitive data exfiltration and potentially enables the external agent to perform actions beyond intended analysis; there is no hidden obfuscation or encoded payload in the code, but the use of those bypass flags and image forwarding is an intentional privacy/exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly takes screenshots of web pages via browser.mjs screenshot and feeds those images to codex exec -i for visual interpretation, so arbitrary/untrusted page content (public websites or user-generated UI) is read by the model and its output directly determines subsequent automated clicks.