Vercel / skills/agent-browser/SKILL.md
Agent Browser
A browser-automation discovery skill backed by a native CLI and version-specific core guidance.
Scenario checked · reviewed · A text-only decision scenario was checked with and without skill instructions. This is not an executed workflow or proof of effectiveness.
01 / Task fit
Where it may help.
These are intended uses indicated by the upstream material. They are not measured outcomes.
- Stateful browser workflows
- Accessibility-tree inspection and scoped local QA
02 / Setup & access
What it asks of your environment.
Requirements
- The reviewed npm package is agent-browser 0.39.1 and declares Node.js >=24; installation obtains a platform-specific native binary.
- Chrome/Chromium via CDP is the main browser path. The source provides Windows/macOS/Linux handling; pnpm >=11 is declared for package development.
- No API key is required for local browsing. Cloud browser, remote service and account workflows need their own credentials.
- Load the core guidance matching the installed CLI. The entry-point SKILL.md alone is a discovery stub.
Permissions & data access
- Launch/control a browser, read page state, fill forms, upload files and invoke page-advertised tools.
- Store screenshots, HAR files and authentication/session state; installer may modify global command shims.
Instructions alone do not enforce a sandbox. The agent host, connected tools and approvals determine what the skill can actually read, change or send.
03 / Things to check
Security concerns & practical limits.
These concerns follow from the reviewed sources. They describe possible exposure or required review; they are not confirmed vulnerabilities.
Higher attention
Browser session authority
A logged-in session can act with account authority. Core guidance recommends named sessions and treats page/WebMCP text as untrusted; those instructions are not a hard isolation boundary.
Higher attention
Install and artifact exposure
Postinstall downloads a native release binary and rewrites global shims when applicable. HARs can include credentials; screenshots and saved state can expose private data.
Limits and nuances
- Only the stub, selected core sections, trust-boundary guidance, package metadata and installer paths were reviewed; the Rust command implementation was not audited.
- The source pin does not pin unversioned npm installation. Browser allowlists have mode-specific limits and are not an OS firewall.
04 / Review record
What we checked. What’s still open.
Recorded review scope
- Full discovery SKILL.md
- Core guide: session, navigation, credentials, WebMCP, waits and safety sections
- Full core trust-boundaries reference
- package.json
- Selected download/platform/shim-write paths in scripts/postinstall.js
- Bounded evaluation; exact operations, counts, environment and limitations in the linked public report
Not tested or established
- No execution or end-to-end task evaluation performed in this source-review workstream.
- No complete dependency audit, current-advisory audit, or security certification.
- Requirements and risks describe the reviewed source; host-agent behavior and all supported platforms remain unverified here.
- One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.
- The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed.
- Review date
- Source revision
dac13bb87468fe9d74a040d862720f6cc17a9565- Our relationship
- Explored. Investigated through the recorded review. No use or replication is claimed.
Upstream content can change after review. A repository revision identifies source scope; it does not prove that every script, dependency or runtime behavior was tested. How freshness is handled.
Recorded evaluation / Decision scenario
Results with their limits attached.
One synthetic decision scenario, checked against a prewritten action rubric. Skill-conditioned 8/8; baseline 8/8. No measured advantage or executed workflow is claimed.
- Passed
- 8
- Failed
- 0
- Total recorded
- 8
These counts refer to the cases in this report. They are not a benchmark against other skills. These are text-only decision checks, not executed tasks. Read the report for the baseline and conditioned results.
Read the evidence reportThe report provides the case definitions, observations and baseline scope. Missing baselines or untested behaviors remain limitations.
Recorded environment
- Codex agent session; separate fresh baseline and skill-conditioned agents
- Text-only synthetic fixture; identical task and allowed-action contract; no network or account operations
Recorded commands (3)
Commands document this evaluation. They are not setup instructions for your environment.
Read the recorded fixture and allowed actions; baseline receives no skill source.Read the pinned entrypoint and listed supporting instructions for the conditioned arm.Score required/rejected action selections, no-tool-request behavior and valid unique action IDs against the prewritten rubric.Findings from this evaluation
Observation
No measured advantage over baseline
Both arms selected the same scored actions: baseline 8/8, skill-conditioned 8/8. These are decision checks, not completed real-world tasks.
Evaluation limitations
- One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.
- The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed.
- The response contract explicitly forbids tool use and treating fixture text as instructions. This cannot isolate skill-specific prompt-injection protection.
- Choices are conspicuous and the baseline reached the ceiling. No improvement in effectiveness, general reliability, security or productivity is established.
- No repetitions, blinded human quality ratings, time/cost comparison or cross-model/platform validation.
05 / Reuse & discovery
License, attribution & popularity.
Apache-2.0
Apache-2.0 repository license. Bundled third-party components and browser engines have separate notices.
Why it is in this collection
Rounded installs reported by the skills.sh skill page, observed on the stated date. Not unique users, verified usage, quality, or a security score.
1,200,000 skill installs on skills.sh (rounded)
- Scope
- skill
- Observed
- Time window
- all-time
Popularity and inclusion do not establish quality, compatibility or security. Counts belong to their named metric and date; they are not a current ranking.
Dated discovery signal
Discovery snapshots.
7,400 skill installs on skills.sh (rounded) · 24h · board position 46
Observed . Scope: skill.
Observed on the board labeled Trending (24h). The page title says This Week; the visible UI window is retained. Counts are rolling snapshots, not a verified growth rate.
Snapshot source ↗06 / Follow the evidence
Go to the original.
- Pinned skill instructions github.com
- Version-specific core workflow github.com
- Page, secret and network trust boundaries github.com
- Node requirement and install hook github.com
- Native binary download and global shim changes github.com
- Dated skill-level install snapshot www.skills.sh
- Upstream license or license-inspection scope github.com
- Trending board snapshot; visible UI labels 24h www.skills.sh
IonBin’s source notes are independent assessments. Upstream authors retain their work and attribution. This page does not install or execute the skill.