browserwing-executor
Fail
Audited by Snyk on Mar 9, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 1.00). The prompt explicitly shows embedding credentials (e.g., "X-BrowserWing-Key: " and a login example that types username "john" and password "secret123") into API requests/commands, which requires the LLM to output secrets verbatim and therefore is high risk.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 1.00). The SKILL.md workflow explicitly instructs the agent to navigate to arbitrary URLs (POST /navigate) and then read page structure and content via GET /snapshot, POST /extract, GET /page-text or GET /page-content, meaning the agent ingests untrusted public web pages whose content can influence subsequent clicks/typing/actions.
Audit Metadata