agent-browser

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes examples and commands that embed secrets and credentials verbatim (e.g., fill "password123", --proxy http://user:pass@..., set credentials user pass, cookies/storage set), which instructs the agent to accept and emit plaintext secrets in CLI/command outputs, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill explicitly navigates to arbitrary public URLs (see "agent-browser open " in SKILL.md) and then snapshots and extracts page content (e.g., "agent-browser snapshot -i", "agent-browser get text body" and templates/capture-workflow.sh and form-automation.sh) so the agent reads and acts on untrusted third-party webpage content that could contain instructions influencing subsequent actions.