agent-browser

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes explicit examples and common workflows that pass plaintext credentials on the command line (e.g., agent-browser fill @e2 "password123" and chained commands), which would require an LLM to include secret values verbatim in generated commands — an exfiltration risk.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.85). Yes — the set includes an explicit malicious domain plus multiple untrusted/unknown domains and staging/local endpoints (site-a.com, site-b.com, staging/prod subdomains, localhost) rather than official vendor/package hosts, so they could be used to distribute malware even though none are direct download links to known installers.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The SKILL.md and accompanying templates explicitly direct the agent to navigate to arbitrary external URLs (agent-browser open ), take snapshots and extract page content (agent-browser snapshot -i, get text body, pdf, screenshots) and then act on that content (click/fill/etc.), so the agent will fetch and interpret untrusted, public third‑party web content as part of its workflow while security controls are opt‑in.