go-rod-master

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt includes examples that embed credentials and tokens directly in code (e.g., ctx.Request.Req().Header.Set("Authorization", "Bearer token123") and browser.MustHandleAuth("username", "password")), which encourages including secret values verbatim in generated outputs.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Rod/stealth at runtime navigates to user-supplied or example URLs and ingests the resulting page DOM/text into the LLM context via element text/HTML extraction (e.g., page.MustNavigate(u) then MustText()/MustEval()), which is outsider-authored free text from public web content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The Installation section includes the command "go run github.com/nichochar/go-rod.github.io/cmd/launcher@latest", which fetches and immediately executes remote Go code to (pre-)download a Chromium binary, so it is a runtime/installation URL that executes remote code.