test-and-break

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly opens and interacts with an arbitrary deployed app URL via "agent-browser open [DEPLOYMENT_URL]" (e.g., https://my-app-staging.vercel.app) and takes snapshots/reads console output and page content, so it ingests untrusted third-party web content that could contain user-generated/attacker-controlled data.