web-testing

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The agent skill guides end-to-end testing with Playwright, including an advisory section on agent browser safety discussing the ingestion of untrusted page content and DOM text during browser interaction.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). The documentation contains references to passwords and keys (e.g., hunter2-REDACTED, sk_live_REDACTED), but these explicitly use the literal redaction suffix -REDACTED, indicating that they are placeholders where real credentials were stripped. According to the scanning protocol, redaction markers of this form must be flagged as active/sensitive placeholders representing stripped secrets.