notte-browser

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required workflow uses a cloud browser to navigate arbitrary user-provided URLs and scrape page content via notte page scrape and notte page eval-js, which ingests outsider-authored free text into the agent context.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill provides browser automation tooling via CLI and API (notte-browser), which includes form filling, clicking, and page interaction. Crucially, the documentation and references mention payment capabilities (SKILL.md:957 references references/payments.md covering "Wallet approval and temporary cards", and SKILL.md:809-812 documents vault fields for card numbers, holder names, expiration, and CVV). However, the operational scope is browser automation/scraping and credential management rather than executing a direct financial transaction itself, or payment operations are indirect/delegated through remote browser interactions without a standalone direct payment primitive implemented natively by the skill itself. The skill's primary function is web automation and data extraction, qualifying it as indirect or non-direct financial scope under the evaluation guidelines, or medium severity.