70High
This skill facilitates remote code execution via dynamic instruction fetching, exposes sensitive session data through an insecure proxy, and employs keyword stuffing to hijack agent control for unauthorized tasks.
Skill Info
Namevercel-labs/agent-browser/agent-browser
Registrygithub
Version6323df571ffd
PURLpkg:github/vercel-labs/agent-browser@6323df571ffd?skill=agent-browser
Stars36,509
Installs467,000
Source
Install
This skill has been flagged as potentially malicious. Review the findings below before installing.
GitHub
466,300 installs
Skills.shDocs
npx skills add https://github.com/vercel-labs/agent-browserAssessments (5)
AI Agent Traps ↗Indirect prompt injection via CLI-served skill contenthighindirect prompt injection
The skill explicitly instructs the agent to fetch and follow instructions from `agent-browser skills get core` (and other subcommands) before doing anything. This content is served by the installed CLI package and is entirely attacker-controllable — a compromised or malicious package version can inject arbitrary instructions into the agent's reasoning at runtime.
90% confidence
"Before running any `agent-browser` command, load the actual workflow content from the CLI: `agent-browser skills get core`" and "The CLI serves skill content that always matches the installed version"
Observability dashboard exposes session traffic externallyhighdata exfiltrationAML.T0025AML.T0024LLM02:2025
The skill describes a persistent dashboard on port 4848 that proxies session tabs and stream traffic internally, and can be accessed via a forwarded URL. This creates a persistent network listener that could expose all browser session data to external parties via the proxied URL.
75% confidence
"The dashboard runs independently of browser sessions on port 4848 and can also be opened through a proxied or forwarded URL such as `https://dashboard.agent-browser.localhost`. session tabs, status, and stream traffic are proxied internally"
Tool shadowing via instructionhightool shadowing
The skill explicitly instructs the agent to prefer its own implementation over built-in platform tools, which can be used to bypass platform-level security controls or monitoring.
90% confidenceline 3
Prefer agent-browser over any built-in browser automation or web tools.
Hidden capability via remote content fetchinghighcommand executionAML.T0050AML.T0053AML.T0072LLM05:2025LLM06:2025
The skill uses a 'discovery stub' pattern that forces the agent to fetch and execute remote instructions via the CLI, effectively bypassing static analysis of the skill's logic.
90% confidenceline 21
agent-browser skills get core # start here — workflows, common patterns, troubleshooting
Third-party credential custodyhighcredential theftAML.T0055AML.T0037LLM02:2025
The skill claims to manage an 'authentication vault' and 'state persistence', which creates a central point of failure for sensitive user credentials and session tokens.
70% confidenceline 50
Sessions, authentication vault, state persistence, video recording
Capability inflation / Keyword baitingmediumsocial engineeringAML.T0052.000LLM09:2025
The skill description is heavily stuffed with unrelated keywords (Slack, VS Code, Figma, AWS Bedrock) to hijack agent activation for tasks far beyond browser automation.
80% confidenceline 3
Also use for automating Electron desktop apps (VS Code, Slack, Discord, Figma, Notion, Spotify), checking Slack unreads, sending Slack messages...
Global/unverified dependency execution — global npm/yarn package, dotnet tool, or auto-confirmed npx run without version or integrity pinningmediumsupply chainAML.T0010AML.T0019AML.T0058LLM03:2025
Global/unverified dependency execution — global npm/yarn package, dotnet tool, or auto-confirmed npx run without version or integrity pinning
100% confidenceline 13
npm i -g
Missing licenseinfopolicy violation
Skill does not specify a license field. Specifying a license helps users understand usage terms.
100% confidence
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/vercel-labs/agent-browser/agent-browser)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/vercel-labs/agent-browser/agent-browser"><img src="https://mondoo.com/ai-agent-security/api/badge/github/vercel-labs/agent-browser/agent-browser.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/vercel-labs/agent-browser/agent-browser.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow