chromatic

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly gives an AI agent a cloud browser that "can access the public internet (to visit websites)" via the Ambit router's SOCKS5 proxy and describes using browser pools for "scraping" and the workflow "Agent can now use the browser" (see "Outbound Traffic", "Common Workflows", and chromatic create sections), meaning the agent will fetch and interpret arbitrary public web content that could contain untrusted instructions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill includes runtime commands that fetch and execute remote code — notably "nix run github:ToxicPine/ambit#chromatic" (fetches the chromatic code from GitHub at install/run time) and the generated MCP entry that runs "npx @playwright/mcp@latest" (which pulls and executes remote npm code) — so external content is required and will execute code during runtime.