browser-automation

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The GitHub repository URLs point to a third‑party/unvetted project (zhexulong/openreverse) that the skill instructs users to clone and run (npm install / runtime installs), which is a common vector for distributing malicious code and matches the high‑risk GitHub/untrusted‑repo indicator.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). High-risk: the skill content includes explicit, intentional instructions and code examples to inject XSS/payloads, intercept and modify network traffic (including escalating roles), and extract cookies/localStorage—behaviors that enable credential theft and unauthorized access.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md 的运行流程在“浏览器场景”中使用 agent-browser open / snapshot 并对页面进行 get text 等读取，这会把网页（通常由外部作者内容生成/可被投毒）中的自由文本输入到 LLM 进行处理。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs cloning and installing OpenReverse from https://github.com/zhexulong/openreverse.git (and references https://github.com/zhexulong/openreverse), which at runtime fetches remote code and runs installation scripts (npm install / npm run), making it a required external dependency that can execute remote code.