browser-use

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes commands that require embedding secret values directly into CLI invocations (e.g., "--secret key=value" and "cookies set "), which would force the LLM to output secrets verbatim if it constructs those commands.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill intentionally includes features that transfer and expose browser session data and credentials (copying local Chrome profiles, full-cookie sync, cookie export/import), plus tunneling and public session sharing and task-secret metadata — all of which enable credential theft and data exfiltration if misused.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). SKILL.md describes runtime browser automation where the agent opens user-supplied URLs and then uses page-derived text/HTML (e.g., via browser-use state, get text, get html, screenshot) that can include outsider-authored free text from arbitrary web pages, which the agent/LLM may ingest for reasoning.