agent-browser

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes explicit examples and common workflows that pass plaintext credentials on the command line (e.g., agent-browser fill @e2 "password123" and chained commands), which would require an LLM to include secret values verbatim in generated commands — an exfiltration risk.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The set includes an explicitly malicious-looking domain (malicious.com), several untrusted/unknown or internal/staging hosts (site-a.com, site-b.com, prod/staging.example.com, localhost) and no verified vendor/package-manager download links or known GitHub releases, so while there are no direct .exe/.msi links shown this mix could easily be used to host or phish untrusted installers or payloads and represents a moderate-to-high risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The SKILL.md and accompanying templates explicitly direct the agent to navigate to arbitrary external URLs (agent-browser open ), take snapshots and extract page content (agent-browser snapshot -i, get text body, pdf, screenshots) and then act on that content (click/fill/etc.), so the agent will fetch and interpret untrusted, public third‑party web content as part of its workflow while security controls are opt‑in.