Agent Browser.Bak
Security checks across malware telemetry and agentic risk
Overview
The skill's instructions generally match a browser-automation CLI, but there are provenance and packaging inconsistencies and missing declared requirements that warrant caution before installing or running it.
Things to check before installing or running this skill: - Verify the upstream package and repository: confirm the exact npm package name (agent-browser) and the GitHub repo referenced in SKILL.md (github.com/vercel-labs/agent-browser) are the legitimate upstream sources and match the skill publisher. The registry metadata, _meta.json, and SKILL.md show inconsistent owner/versions — treat that as suspicious provenance. - Confirm required tooling: SKILL.md instructs use of git and pnpm for building from source, but these are not declared in required binaries. If you plan to build, ensure git and pnpm are installed and run builds in an isolated environment. - Prefer inspecting the npm package/repo before global install: run npm pack or inspect the repo source instead of immediately doing npm install -g, or install in a sandbox/container to limit impact of arbitrary code. - Be cautious with file uploads and global npm installs: the agent-browser CLI can read/write files (screenshots, uploads). Only allow it access to directories you trust and avoid uploading sensitive files. Global npm installs require elevated permissions — prefer local installs. - If you need higher assurance, ask the publisher for a canonical repo/homepage or a signed release. The current metadata mismatches and missing provenance are the primary reasons this skill is flagged 'suspicious.'
SkillSpector
SkillSpector findings are pending for this release.
VirusTotal
No VirusTotal findings