agent-browser

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt contains multiple examples and workflows that embed plaintext secrets directly into commands and form fills (e.g., agent-browser fill @e2 "password123", state files with session tokens, echo "pass" | ...), which would require an LLM to handle and output secret values verbatim.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The list mixes legitimate/documentation pages (e.g., lightpanda docs, GitHub login and example.com placeholders) with multiple ambiguous/unknown domains (site-a.com, site-b.com), a localhost entry and an explicit "malicious.com" — the presence of unknown/untrusted hosts and an explicitly malicious domain in a download/execution context makes the collection suspicious for malware distribution.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly navigates to arbitrary external URLs and ingests page content (e.g., SKILL.md "agent-browser open " plus snapshot/get text commands and templates like templates/capture-workflow.sh and form-automation.sh) so the agent reads untrusted public web pages and uses that content to decide and perform follow-up actions.