puppeteer

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's SKILL.md explicitly shows workflows and functions that navigate to arbitrary public URLs (e.g., page.goto(url) and the scrapePage/scrapeInfiniteScroll/authenticateAndScrape examples and MCP tools like puppeteer_get_content) and then evaluate/document.body.textContent or execute page.evaluate, meaning it fetches and interprets untrusted third-party web content which can influence subsequent automated actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's MCP configuration invokes npx to fetch and run external packages at runtime (e.g., npx -y @nicholasoxford/puppeteer-mcp and npx -y @anthropics/puppeteer-mcp), which would execute remote code the agent depends on for its MCP tools.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). The skill includes explicit examples that disable Chromium's sandbox (--no-sandbox, --disable-setuid-sandbox), which is a direct bypass of a security mechanism even though it doesn't request sudo, modify system files, or create users.