browser

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider free text can enter the LLM context when the runtime reads arbitrary third-party page content at runtime via cli-jaw browser fetch/open (public web pages) and/or cli-jaw browser text/get-dom/snapshot after navigate, which ingests that page’s extracted prose/DOM into the agent’s context.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). The skill explicitly recommends disabling Chrome's sandbox via CHROME_NO_SANDBOX=1 (a security bypass) and includes destructive/privilege-impacting commands (cleanup-runtimes --close --force, reset) that modify system/browser state, so it pushes the agent toward compromising the host state.