open-source

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.30). The docs include instructions and examples that enable disabling security and programmatic access to cookies, 2FA secrets, and low-level CDP/DOM extraction—weakening security boundaries without explicit malicious intent.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (medium risk: 0.30). The quickstart docs include a direct curl|sh install command that fetches and runs a remote shell script from https://browser-use.com/profile.sh, i.e., downloading and executing code from browser-use.com.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The quickstart includes commands that fetch and execute remote code (curl -fsSL https://browser-use.com/profile.sh | sh) and clone a repo then run setup scripts (git clone https://github.com/browser-use/browser-use), which are runtime external dependencies that execute remote code.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I inspected the documentation for literal, high-entropy credentials. I found one base32-style TOTP secret explicitly provided in an example: 'JBSWY3DPEHPK3PXP'. This is a high-entropy value that can be used to generate 2FA codes (i.e., it is a usable secret), so it should be flagged.

Other occurrences that look like keys (e.g., "your-api-key", "your-key", "your_key", "proxy-pass", "my-password", UUIDs, or placeholders like 'your-profile-id') are documentation placeholders or simple example values and were ignored per the rules (placeholders / low-entropy setup values).