agent-browser

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes explicit examples and common workflows that pass plaintext credentials on the command line (e.g., agent-browser fill @e2 "password123" and chained commands), which would require an LLM to include secret values verbatim in generated commands — an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The SKILL.md and accompanying templates explicitly direct the agent to navigate to arbitrary external URLs (agent-browser open ), take snapshots and extract page content (agent-browser snapshot -i, get text body, pdf, screenshots) and then act on that content (click/fill/etc.), so the agent will fetch and interpret untrusted, public third‑party web content as part of its workflow while security controls are opt‑in.