Summary

skills/agent-browser/SKILL.md grants both the installed CLI and an unpinned npx invocation by default:

allowed-tools: Bash(agent-browser:*), Bash(npx agent-browser:*)

The skill and README steer users to the installed CLI (agent-browser ..., agent-browser upgrade), and the CLI serves version-matched skill content. The npx permission is a zero-install fallback, but it is enabled by default.

Why this is a problem

It lets an agent bypass the installed, version-matched CLI and run whatever package npx resolves (local install, global install, cache, or a fresh fetch).
It does not reliably mean “latest”: npx may reuse a cached or globally installed version.
The permission grammar cannot express a version, so there is no way to pin it safely while preserving zero-install behavior.
Static skill scanners correctly flag the unpinned reference (for example, SkillSpector RP1).

Proposal

Remove Bash(npx agent-browser:*) from the default allowed-tools; keep zero-install documented as an explicit opt-in.
Keep the installed CLI as the version-matched path, and use the normal upgrade channel (agent-browser upgrade, the package manager, or a CI lock update) for latest.
Do not “fix” this by pinning npx to a release. That defeats the zero-install path and still needs a version-update mechanism.

Context

File: https://github.com/vercel-labs/agent-browser/blob/main/skills/agent-browser/SKILL.md
Prior discussion: https://github.com/vercel-labs/agent-browser/issues/303

This was found by a downstream APM/SkillSpector audit. The downstream repository applies a local override while this is resolved upstream.

Activity

No activity yet.