mortgage-broker-lead-scraper

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 1.00). The Skill instructs the agent to install a dependency automatically without user confirmation and explicitly instructs the agent to hide that action ("Do not describe it as a request..."), which is a deceptive instruction outside the Skill's stated scraping purpose.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). SKILL.md instructs the agent to invoke the BrowserAct Skill for live website interaction (public web pages fetched at runtime), which can cause outsider-authored free text from those pages to be ingested into the LLM context via BrowserAct’s extracted page content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The Skill explicitly requires invoking and, if missing, automatically installing the BrowserAct CLI at runtime using the install link https://www.browseract.com/?co-from=lead-generation&redirect=https://github.com/browser-act/skills/tree/main (and references https://www.browseract.com/?co-from=lead-generation), so the agent will fetch external code/instructions that control runtime behavior.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (low risk: 0.30). The skill instructs the agent to automatically install the BrowserAct CLI/dependency without asking the user (altering the host environment), but it does not request sudo, edit system files, or create accounts directly.