browser_visible

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The SKILL.md explicitly instructs starting a headed browser and opening arbitrary URLs (e.g., the "open" action like {"action": "open", "url": "https://example.com"}) and using "snapshot"/click/type on page content, so the agent will fetch and read untrusted public web pages whose content could influence its actions.