agent-browser

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt includes examples that embed passwords/credentials directly in CLI commands (e.g., agent-browser fill @e2 "password123"), which would require the LLM to output secret values verbatim and thus poses a high exfiltration risk despite also showing safer env-var alternatives.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). The skill's core workflow and command reference (SKILL.md and references/*.md) explicitly instruct the agent to open arbitrary URLs (agent-browser open ), snapshot and extract page text (agent-browser snapshot -i, get text body) and run eval on page content (agent-browser eval), and the templates (templates/capture-workflow.sh, form-automation.sh, templates/authenticated-session.sh) show fetching public web pages and using their contents to drive clicks/fills/state saving—meaning untrusted, user-generated web content is ingested and directly influences subsequent tool actions.