agent-browser

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes explicit examples and common workflows that pass plaintext credentials on the command line (e.g., agent-browser fill @e2 "password123" and chained commands), which would require an LLM to include secret values verbatim in generated commands — an exfiltration risk.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). These URLs include an explicit "malicious.com" plus several untrusted/unknown domains (site-a/site-b), placeholder/example hosts and a login page (github.com/login) but no clear official vendor or package-manager download endpoints, so downloading/executing files from them poses a moderately high risk of malware or credential theft.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The SKILL.md and accompanying templates explicitly direct the agent to navigate to arbitrary external URLs (agent-browser open ), take snapshots and extract page content (agent-browser snapshot -i, get text body, pdf, screenshots) and then act on that content (click/fill/etc.), so the agent will fetch and interpret untrusted, public third‑party web content as part of its workflow while security controls are opt‑in.