Chrome Bridge Automation

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill's examples and command patterns demonstrate embedding credentials directly (e.g., filling a password in an act prompt and showing API key values in .env examples), which encourages including secret values verbatim in generated commands or prompts.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill connects the agent to the user's Chrome browser and explicitly navigates to arbitrary URLs (e.g., connect --url https://example.com), takes screenshots, and scrapes/extracts data from web pages, so it ingests untrusted public third‑party content from arbitrary websites.