sap-browser-automation

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required auth/bootstrap workflow uses the bundled scripts/cdp-agent.mjs inspect path to read document.body.innerText and accessibility node names from the live, authenticated SAP page DOM (outsider-authored page content controlled by the SAP/IdP sites, not by the operating user), which becomes LLM-readable prose in the agent tool output/context.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). This skill directs copying and cloning the user's Edge profile, running local PowerShell/Node scripts, and exporting/importing browser auth state (cookies/localStorage), which are state-modifying operations that can alter or expose sensitive local files even though it asks for user approval and does not request sudo.