kimi-webbridge

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The URL hosting a direct .zip extension (kimi-web-img.moonshot.cn) is a third-party downloadable archive intended to be loaded unpacked into the browser (a high-risk distribution pattern); the other URLs are official pages or local endpoints.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill intentionally provides an AI full control over the user's real browser sessions (including arbitrary JS/CDP execution, network capture, file writes/uploads) and even instructs starting a local daemon “without asking the user,” enabling clear avenues for credential theft, data exfiltration, and persistent/hidden access.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). To perform any website interaction, the workflow can call tools like navigate and then ingest the resulting page’s accessibility/text via snapshot (accessibility tree), so outsider-authored page text from arbitrary URLs the user asks to open can be read at runtime.