Vercel Sandbox

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:16 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent browser-automation guide for Vercel Sandbox, with some install and automation risks users should manage.

Install only if you intend to run browser automation in Vercel Sandbox. Pin package versions, use a lockfile or controlled snapshot build, keep Vercel tokens scoped, and require explicit user approval before submitting forms, authenticating to sites, or scheduling recurring jobs against third-party services.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:66

Finding

Unpinned Third-Party Packages Are Installed and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13, 66–67, and 199–200
Vulnerability Type: Supply-chain exposure through unpinned dependencies
Risk Level: Medium

Vulnerable Code

bash

pnpm add @vercel/sandbox

ts

await sandbox.runCommand("npm", ["install", "-g", "agent-browser"]);
await sandbox.runCommand("npx", ["agent-browser", "install"]);

The same installation pattern is used when creating a reusable sandbox snapshot:

ts

await sandbox.runCommand("npm", ["install", "-g", "agent-browser"]);
await sandbox.runCommand("npx", ["agent-browser", "install"]);

const snapshot = await sandbox.snapshot();
return snapshot.snapshotId;

Technical Analysis

The documented commands do not pin exact versions of @vercel/sandbox or agent-browser. Package managers can therefore resolve a different release whenever the instructions are followed. The effective code executed by the workflow can change after the Skill has been reviewed, without any corresponding modification to SKILL.md.

Installing agent-browser globally may execute package lifecycle scripts and makes the installed executable available to subsequent sandbox commands. The npx invocation then executes package-controlled code and installs browser components. In the snapshot workflow, the resulting software is captured in a reusable VM image, potentially propagating a compromised dependency across later browser-automation runs.

This finding concerns unsafe dependency resolution. The audited file contains no evidence that the named packages are currently malicious.

Attack Path

1. An attacker compromises a package release, maintainer account, transitive dependency, or relevant package-distribution channel.
2. A developer or deployed workflow follows the Skill and installs the package without an exact version or integrity constraint.
3. The package manager resolves the attacker-controlled or compromis ...[truncated 1111 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin exact reviewed versions of all packages, including @vercel/sandbox and agent-browser.
2. Commit and review the appropriate lockfile, and use immutable installation modes such as pnpm install --frozen-lockfile or npm ci.
3. Replace ambiguous execution commands with explicitly versioned invocations, or invoke a dependency installed from the verified lockfile rather than allowing npx to resolve packages dynamically.
4. Verify package provenance and integrity using registry integrity metadata, checksums, signatures, or an approved internal package mirror.
5. Disable unnecessary package lifecycle scripts where operationally possible and review any scripts that must remain enabled.
6. Build production sandbox snapshots only through a controlled CI pipeline using pinned dependencies and reproducible build inputs.
7. Record the exact dependency versions and snapshot build provenance, scan snapshots before publication, and rebuild them promptly when trusted security updates are approved.
8. Apply least privilege and outbound network restrictions to sandbox workloads to reduce the impact of a compromised dependency.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md

if (!snapshotId) {
    await sandbox.runCommand("sh", [
      "-c",
      `sudo dnf clean all 2>&1 && sudo dnf install -y --skip-broken ${CHROMIUM_SYSTEM_DEPS.join(" ")} 2>&1 && sudo ldconfig 2>&1`,
    ]);
    await sandbox.runCommand("npm", ["install", "-g", "agent-browser"]);
    await sandbox.runCommand("npx", ["agent-browser", "install"]);

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.

md

if (!snapshotId) {
    await sandbox.runCommand("sh", [
      "-c",
      `sudo dnf clean all 2>&1 && sudo dnf install -y --skip-broken ${CHROMIUM_SYSTEM_DEPS.join(" ")} 2>&1 && sudo ldconfig 2>&1`,
    ]);
    await sandbox.runCommand("npm", ["install", "-g", "agent-browser"]);
    await sandbox.runCommand("npx", ["agent-browser", "install"]);

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 262)May include surrounding context.

md

| Variable | Required | Description |
|---|---|---|
| `AGENT_BROWSER_SNAPSHOT_ID` | No (but recommended) | Pre-built sandbox snapshot ID for sub-second startup (see above) |
| `VERCEL_TOKEN` | No | Vercel personal access token (for local dev; OIDC is automatic on Vercel) |
| `VERCEL_TEAM_ID` | No | Vercel team ID (for local dev) |
| `VERCEL_PROJECT_ID` | No | Vercel project ID (for local dev) |

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest description includes broad triggers like any task requiring Chrome in a Vercel Sandbox, which can cause the skill to be invoked in overly general situations. In an agent setting, overbroad invocation increases the chance of unnecessary browser automation, form interaction, or external side effects without sufficiently specific user intent.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md

if (!snapshotId) {
    await sandbox.runCommand("sh", [
      "-c",
      `sudo dnf clean all 2>&1 && sudo dnf install -y --skip-broken ${CHROMIUM_SYSTEM_DEPS.join(" ")} 2>&1 && sudo ldconfig 2>&1`,
    ]);
    await sandbox.runCommand("npm", ["install", "-g", "agent-browser"]);
    await sandbox.runCommand("npx", ["agent-browser", "install"]);

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.

md

if (!snapshotId) {
    await sandbox.runCommand("sh", [
      "-c",
      `sudo dnf clean all 2>&1 && sudo dnf install -y --skip-broken ${CHROMIUM_SYSTEM_DEPS.join(" ")} 2>&1 && sudo ldconfig 2>&1`,
    ]);
    await sandbox.runCommand("npm", ["install", "-g", "agent-browser"]);
    await sandbox.runCommand("npx", ["agent-browser", "install"]);

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill provides examples for multi-step form submission and scheduled recurring browser actions but does not include a warning that these operations can modify external systems, trigger transactions, or repeatedly hit third-party services. In an automation skill, omission of such guardrails materially raises misuse risk because users or agents may treat the examples as safe defaults.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.