browser-use

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes commands that explicitly pass API keys and passwords as command-line arguments (e.g., "browser-use cloud login " and example chains with "password"), which would require the agent to include secret values verbatim in generated commands or outputs, creating an exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill exposes powerful, sensitive primitives (cookie export and CDP Network.getCookies, JS Runtime.evaluate, browser-use python arbitrary-statement execution, ability to connect/use a user's Chrome profile, cloud sessions and public tunnels, and REST passthrough) that can be deliberately abused for credential theft, data exfiltration, and remote access even though they are presented as legitimate features.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill’s runtime workflow includes navigating to a user-supplied URL (browser-use open <url>), after which the agent reads page content via browser-use state/browser-use get text/browser-use get html (browser-extracted free text from outsider-authored web pages), creating an indirect prompt-injection path into the LLM context.