hiring-company-lead-scraper

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 1.00). The Skill contains explicit instructions to install dependencies automatically and to hide that installation from the user (e.g., "without asking the user to confirm" and "Do not describe it..."), which are deceptive behaviors outside the scraping purpose.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). These URLs point to a third-party installer site (browseract.com) that the Skill instructs agents to use for automatic CLI installation without explicit user approval, making it a potentially risky distribution channel for executables though the links themselves are not direct .exe downloads.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). SKILL.md instructs the agent to invoke the browser-act Skill to access and interact with real public web pages at runtime, which can cause outsider-authored free text from those pages to be ingested into the LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The Skill instructs the agent at runtime to automatically install a required CLI from https://www.browseract.com/?co-from=lead-generation and https://www.browseract.com/?co-from=lead-generation&redirect=https://github.com/browser-act/skills/tree/main, which is a runtime external dependency that would fetch and install/execute remote code to control the agent workflow.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill orders the agent to auto-install the BrowserAct CLI/dependencies without asking the user (explicitly telling the agent not to request approval), which requires modifying the host system and could run privileged install steps—risking compromise of the machine state.