The skill is vulnerable to command injection via
Claims to do
Dogfood: Systematically explore a web application, find issues, and produce a report with full reproduction evidence for every finding.
Actually does
This skill uses `Bash` to execute commands, primarily leveraging the `agent-browser` tool. It navigates to a user-provided `TARGET_URL`, interacts with web elements (fills forms, clicks buttons), takes screenshots, records video, and captures browser console logs and errors. It saves all collected evidence (screenshots, videos, authentication state) and a markdown report into a local output directory.
The skill executes Bash commands using user-controlled parameters such as `{OUTPUT_DIR}`, `{TARGET_URL}`, `{EMAIL}`, and `{PASSWORD}`. Without proper sanitization by the orchestrating system, these parameters could be exploited for arbitrary command injection.
Bash(agent-browser:*), Bash(npx agent-browser:*), mkdir -p {OUTPUT_DIR}/screenshots, cp {SKILL_DIR}/templates/dogfood-report-template.md {OUTPUT_DIR}/report.md, agent-browser --session {SESSION} open {TARGET_URL}The skill explicitly handles user-provided `{EMAIL}` and `{PASSWORD}` for authentication and saves the browser's authentication state to `{OUTPUT_DIR}/auth-state.json`. If this state file contains unencrypted credentials or session tokens and the output directory is not secured, it poses a significant risk of credential theft or session hijacking.
agent-browser --session {SESSION} fill @e1 "{EMAIL}", agent-browser --session {SESSION} fill @e2 "{PASSWORD}", agent-browser --session {SESSION} state save {OUTPUT_DIR}/auth-state.jsonThe skill's core function is to systematically explore web applications, collect screenshots, videos, and console logs to identify issues. While intended for benign QA, this capability could be repurposed for malicious reconnaissance if the agent is directed to sensitive internal systems or attacker-controlled targets.
description: Systematically explore and test a web application to find bugs... Produces a structured report with full reproduction evidence -- step-by-step screenshots, repro videos, and detailed repro steps for every issue.
The skill relies on the `agent-browser` binary and external Markdown files (`references/issue-taxonomy.md`, `templates/dogfood-report-template.md`). A compromise of the `agent-browser` tool or manipulation of these referenced files could lead to altered agent behavior, biased instructions, or malicious actions.
allowed-tools: Bash(agent-browser:*), Read [references/issue-taxonomy.md], cp {SKILL_DIR}/templates/dogfood-report-template.mdThe skill instructs the agent to 'start immediately with defaults' and 'Do not ask clarifying questions' in certain scenarios. This pattern reduces human oversight and confirmation steps, which could be abused in a different context or with a compromised skill to perform unintended actions without explicit user approval.
If the user says something like "dogfood vercel.com", start immediately with defaults. Do not ask clarifying questions unless authentication is mentioned but credentials are missing.
[](https://mondoo.com/ai-agent-security/skills/github/vercel-labs/agent-browser/dogfood)<a href="https://mondoo.com/ai-agent-security/skills/github/vercel-labs/agent-browser/dogfood"><img src="https://mondoo.com/ai-agent-security/api/badge/github/vercel-labs/agent-browser/dogfood.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/vercel-labs/agent-browser/dogfood.svgSkills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.