browser-cdp

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs running evals that read localStorage tokens or document.cookie and to "extract auth tokens," which requires the agent/LLM to receive and potentially include secret token values verbatim in outputs or subsequent commands.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). High risk: the skill and script intentionally copy browser profile/auth files and expose CDP eval commands that read localStorage/cookies, enabling credential access and potential data exfiltration if misused.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). 该 skill 的运行时路径只会读取本机 Chrome 的 CDP 端点响应（如 http://127.0.0.1:<port>/json/version）并通过 agent-browser --cdp <port> eval/open 读取页面内容，未包含从外部/陌生来源直接摄取的 free-text输入通道（除非调用方自行提供 <URL>）。

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs running scripts that will kill the user's regular Chrome processes, delete/reset a debug profile (clearing ~/chrome-debug-profile), and run destructive kill/taskkill commands (and suggests a global npm install), i.e. it directs state-changing and potentially destructive operations on the host even if it recommends obtaining user consent first.