Audit candidate: vercel-labs/agent-browser

[xiaolai]

Repo

https://github.com/vercel-labs/agent-browser

Field	Value
Stars	32739
Source	manual queue (2026-05-12 discovery batch)
Description	Browser automation CLI for AI agents

Next Steps

1. Review the repo — check CONTRIBUTING.md, recent activity, PR history
2. If worthy: add label audit-ready to trigger the audit workflow
3. If not: close this issue

Checklist

• Accepts contributions
• Updated in last 60 days
• Not a fork or mirror
• Has meaningful NL artifacts

[github-actions]

Audit Complete: vercel-labs/agent-browser

NL Score: 99/100 | Security: BLOCKED | Artifacts: 7 | Strategy: single

NLPM Audit: vercel-labs/agent-browser

Date: 2026-05-13 | Artifacts: 7 | Strategy: single
NL Score: 99/100
Security: BLOCKED
Bugs: 0 | Quality Issues: 2 | Security Findings: 6

NL Score Summary

File	Type	Score	Top Issue
skill-data/dogfood/SKILL.md	skill	97	Bash(npx agent-browser:*) in allowed-tools contradicts body prohibition of npx
skill-data/vercel-sandbox/SKILL.md	skill	98	No allowed-tools declared; inconsistent with all five other SKILL.md files
skill-data/agentcore/SKILL.md	skill	100	—
skill-data/core/SKILL.md	skill	100	—
skill-data/electron/SKILL.md	skill	100	—
skill-data/slack/SKILL.md	skill	100	—
skills/agent-browser/SKILL.md	skill	100	—

Weighted average: 695 / 7 = 99/100

Security Scan

Severity	Count
Critical	0
High	3
Medium	2
Low	1

Execution Surface Inventory

Surface	Files
Hooks	0
Scripts (.sh, .js)	10 — scripts/build-all-platforms.sh, scripts/check-version-sync.js, scripts/copy-native.js, scripts/postinstall.js, scripts/sync-version.js, scripts/windows-debug/provision.sh, scripts/windows-debug/run.sh, scripts/windows-debug/start.sh, scripts/windows-debug/stop.sh, scripts/windows-debug/sync.sh
MCP configs	0
Package manifests	1 — package.json

Security Findings

#	Severity	File	Line	Pattern	Description
1	HIGH	package.json	25	SEC-postinstall-script	postinstall lifecycle hook auto-runs node scripts/postinstall.js on every npm install; script downloads native binary over network and rewrites global bin entries
2	HIGH	scripts/postinstall.js	258	SEC-file-write-outside-repo	symlinkSync replaces the agent-browser symlink in npm global bin dir ($npm_prefix/bin/), a system PATH directory outside the repo
3	HIGH	scripts/postinstall.js	301	SEC-file-write-outside-repo	writeFileSync overwrites .cmd and .ps1 shims in the Windows global npm prefix dir outside the package
4	MEDIUM	scripts/postinstall.js	49	SEC-network-download	Downloads platform-specific native binary from GitHub Releases over HTTPS; URL uses package.json version; no checksum verification before chmodSync
5	MEDIUM	scripts/postinstall.js	27	SEC-shell-true	execSync('ldd --version 2>&1 || true', ...) — command string is fully hardcoded (false positive; noted for pattern awareness)
6	LOW	scripts/windows-debug/run.sh	25	SEC-shell-true	$* captured and forwarded as a PowerShell command to remote EC2 via AWS SSM; intentional developer debug tool, not a user-facing surface

Bugs (PR-worthy)

No NL bugs found. All seven SKILL.md files contain the required name and description frontmatter fields and carry no broken internal references.

Security Fixes (PR-worthy, Medium/Low only)

Blocked: do not open PRs while security status is BLOCKED. Suggestions below are for reference only.

---

Full report: https://github.com/xiaolai/nlpm-for-claude/blob/main/auditor/audits/vercel-labs-agent-browser.md

SECURITY BLOCKED: Critical/High security issues found. Do NOT submit automated PRs. Manual security review required.

[github-actions]

Security disclosure auto-filing failed (default GITHUB_TOKEN cannot create issues on third-party repos). Body queued at auditor/disclosures-pending/vercel-labs-agent-browser.md for manual filing.