ziniao-webdriver-doc

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The document explicitly requires every API call (updateCore, getBrowserList, startBrowser, stopBrowser, ClearOnline, etc.) to include company/username/password, which would force an LLM to accept or embed those secret credentials verbatim in generated requests/code, creating an exfiltration risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's runtime code (get_chromedriver_path) queries https://googlechromelabs.github.io/chrome-for-testing/known-good-versions-with-downloads.json and then downloads the ChromeDriver binary (download_url) at runtime, which fetches and installs/executes remote code that the skill requires to operate.