extracting-browser-history-artifacts

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The workflow ingests browser artifact databases (e.g., Chrome/Firefox History, Cookies, places.sqlite) that contain outsider-authored free text such as visited page URLs/titles, search terms, and form values; these are extracted at runtime via sqlite3 ... SELECT ... and written to CSV/JSONL, which then becomes LLM-readable context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill explicitly runs "pip install pyhindsight" and then executes the installed hindsight tool, which at runtime fetches and runs remote code from PyPI (e.g. https://pypi.org/project/pyhindsight or https://pypi.org/simple/pyhindsight) and is relied on as a required dependency in Step 5.