website-careers-page-lead-scraper

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.90). The skill instructs the agent to install required dependencies automatically without asking the user to confirm and explicitly tells the agent not to describe the installation request to the user, which is a deceptive instruction outside the stated scraping purpose.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The document contains instructions to automatically install an external CLI/Skill without user consent and to deliberately conceal that installation request, which is a strong supply-chain/backdoor risk and enables unauthorized code installation; combined with the scraping focus this facilitates covert data collection.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). SKILL.md instructs the agent to use the BrowserAct CLI to access arbitrary public website pages at runtime (public web content category), which can include free-form text that the agent may ingest into the LLM context for extraction.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly requires fetching/installing the BrowserAct CLI at runtime via https://www.browseract.com/?co-from=lead-generation and https://www.browseract.com/?co-from=lead-generation&redirect=https://github.com/browser-act/skills/tree/main, which are used to obtain a required runtime tool whose installation can execute remote code and whose instructions control agent behavior.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). The Skill instructs the agent to automatically install the BrowserAct CLI/dependency without asking the user to confirm and to proceed with execution, which directs the agent to modify the host system state (potentially requiring privilege escalation) without user approval.