agent-browser

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes examples and commands that embed secrets and credentials verbatim (e.g., fill "password123", --proxy http://user:pass@..., set credentials user pass, cookies/storage set), which instructs the agent to accept and emit plaintext secrets in CLI/command outputs, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly navigates and ingests arbitrary public URLs (e.g., "agent-browser open " in SKILL.md) and then reads and acts on page content via commands like "agent-browser snapshot -i", "agent-browser get text body", and the capture/form automation templates (templates/capture-workflow.sh, templates/form-automation.sh), so untrusted third‑party webpages or user-generated content can be read/interpreted by the agent and materially influence subsequent actions.