tap-web

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes a concrete example that passes credentials verbatim on the command line (tap browser fill @e1 "me@example.com" @e2 "secret"), which requires the LLM to handle and emit secret values directly — an insecure pattern.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Most links are to well-known or placeholder sites, but the raw.githubusercontent.com link (raw.githubusercontent.com/vaayne/tap/main/scripts/install.sh) is a direct shell script from a user repo — a high-risk pattern because downloading/running unknown install.sh files is a common malware distribution vector.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider free text can be ingested when the required workflow uses tap fetch <url> or tap browser open <url> to retrieve arbitrary public web page content at runtime, which is then read/processed by the agent’s LLM context (e.g., article text, rendered DOM text, or captured network response bodies).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill includes an "Install fallback" that runs a remote install script at runtime via shell (curl -fsSL https://raw.githubusercontent.com/vaayne/tap/main/scripts/install.sh | sh), which fetches and executes remote code and is presented as a required fallback installation step.