agent-browser

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt contains examples that pass plaintext credentials inline (e.g., agent-browser fill @e2 "password123", proxy URLs with user:pass, and set credentials user pass), which would require the agent to include secret values verbatim in generated commands or outputs.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider free text can be ingested when the runtime uses agent-browser open <url> to fetch a public page and then agent-browser snapshot/get text returns the page’s DOM text (authored by the site’s outsiders) into the agent’s LLM context.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill instructs running and modifying local Chrome with commands that kill processes and disable sandboxing/other security flags (e.g., --no-sandbox, --disable-gpu-sandbox, remote debugging with a user profile), which explicitly bypasses security mechanisms and can modify system state.