agent-browser

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes multiple examples and commands that embed plaintext secrets (passwords, card numbers, and session tokens) directly into CLI invocations and saved state, which would encourage or require an LLM to include secret values verbatim in generated commands or outputs.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The list includes an explicit malicious domain (https://malicious.com), which is a clear suspicious download/source indicator and matches high-risk patterns for malware distribution.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow repeatedly snapshots and extracts page content and accessibility trees from whatever URL it navigates to (e.g., agent-browser open <url> then agent-browser snapshot -i and agent-browser get text ...), so an outsider-authored page can inject misleading free text into the model context.