computer-use-agents

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill instructs LLMs to emit structured "type" actions (e.g., {"type":"type","text":"..."}) and browser-fill actions that include plaintext "text" fields which can require the model to output secrets (passwords, API keys, tokens) verbatim, creating an exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The content includes high-risk, dual-use capabilities (automatic full-screen screenshots sent to external LLM APIs, an LLM-invokable bash tool that runs arbitrary shell commands, and explicit evasion techniques to mimic human behavior/rotate fingerprints) that enable data exfiltration, remote code execution, and stealthy evasion — all of which can be readily abused as backdoors or for malicious automation.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s runtime loop ingests outsider-controlled free text via the task argument (user-supplied) into the vision model prompt inside ComputerUseAgent.run as {"type":"text","text": f"Task: {task}... }, which can be crafted for prompt-injection.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill contains explicit system-modifying operations (Dockerfile RUN apt-get/useradd/setcap), code that launches docker containers on the host, and a bash/text-editor tool that runs arbitrary shell commands and writes files, which together enable creating users and changing system state.