agent-browser

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.30). The documentation instructs how to rotate/authenticate proxies, intercept network requests, and save/load authentication state and cookies—guidance that enables evasion of rate limits and session reuse, which is suspicious but not explicitly malicious.

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill includes explicit plaintext password examples (e.g., agent-browser fill ... "password123") which instruct an agent to emit secret values verbatim in commands, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s required workflow uses agent-browser to navigate to a user-supplied URL, then ingests outsider-controlled free text from the resulting page via agent-browser snapshot -i and agent-browser get text body (templates like capture-workflow.sh).