agent-browser

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill's CLI exposes commands that fill form fields with literal string arguments (e.g., agent-browser fill @e2 "password123"), so an agent would need to include user secrets verbatim in generated commands/outputs, creating exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The SKILL.md explicitly instructs the agent to navigate and ingest arbitrary public web pages (e.g., "agent-browser open ", "agent-browser snapshot -i", "agent-browser get text @e1" and "agent-browser wait --text ..."), so the agent will fetch and interpret untrusted third‑party content from arbitrary URLs as part of its workflow and that content can change subsequent interactions.