playwright

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt contains hard-coded secrets (e.g., 'password123', 'password', and 'Authorization': 'Bearer token123') and example code that embeds them verbatim into requests and form fills, which requires the LLM to output secret values directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill's examples (e.g., page.goto(url), captureContent(url), and scrapeProducts(url)) explicitly load and scrape arbitrary external web pages and read their text/attributes, thereby ingesting untrusted public third‑party content that could contain injected instructions.