Why this verdict
- inconclusive: gap invalid_judge_finding
- inconclusive: gap no_tools_extracted at package.json
- inconclusive: gap request_unanswered
- inconclusive: unresolved question on EXEC
- inconclusive: unresolved question on EXFIL
Security findings 0
No individual findings recorded
The inconclusive verdict rests on the open questions and coverage gaps below; 4 candidate findings were refuted on review.
Open questions 2
What the analysis could not settle from the code alone.
Where does telemetryStorage.sendEvents send data, and is there an opt-out? The destination and payload are not visible in the shown units.
Data exfiltration
[file request src/tools/browser-eval.ts] What install and usage instructions does browser_eval return to the agent? Does it direct the agent to run a remote or unpinned installer, or to run commands without user confirmation?
Code execution
Refuted findings 4
Candidates the review stage examined and rejected, kept for transparency.
Data exfiltration
criticalRefutedmedium confidenceOn shutdown the server spawns a detached, silent child process (flush-events.js) with aggregated tool-usage counts as an argument, which sends them to a telemetry endpoint via telemetryStorage.sendEvents; the data is limited to tool names and counts, but the detached background send is not declared in server.json.
detached: true,
Why it was refuted
The detached flusher only sends tool names and invocation counts to the vendor's own telemetry endpoint. That is limited vendor usage telemetry, not exfiltration of sensitive data, and the same send path honours the NEXT_TELEMETRY_DISABLED opt-out.
Data exfiltration
criticalRefutedmedium confidenceThe server undeclared-ly posts usage telemetry (persistent anonymous ID, salted hash of the working directory, OS/arch/node version, tool usage counts) to telemetry.nextjs.org, with opt-out only via NEXT_TELEMETRY_DISABLED=1; the data is limited and the destination is the vendor's own, so intent is plausibly honest.
const response = await fetch(TELEMETRY_ENDPOINT, {Why it was refuted
This is default-on vendor telemetry with an explicit opt-out. The payload is an anonymous ID, a salted hash of the working directory, system info and tool counts, with no source or credential data, so the harm gate fails.
Data exfiltration
criticalRefutedmedium confidenceTelemetryStorage builds a payload of persistent anonymous ID, salted hash of the working directory, and OS/arch/node version, and POSTs it to telemetry.nextjs.org unless NEXT_TELEMETRY_DISABLED=1; it is on by default and sends no source or credential data.
const TELEMETRY_ENDPOINT = "https://telemetry.nextjs.org/api/v1/record"
Why it was refuted
The endpoint constant is the vendor telemetry target. The code sends only an anonymous ID, a salted one-way hash of the cwd and system info, and honours an opt-out, so no sensitive data leaves.
Supply chain
highRefutedlow confidenceThe browser_eval tool tells the agent to globally install the unpinned 'agent-browser' npm package and then load usage instructions from that CLI at runtime, so unpinned remote code and instructions drive the agent; this is disclosed in the tool description and is the tool's stated purpose.
const INSTALL_COMMAND = "npm install -g agent-browser"
Why it was refuted
The tool description states that it tells the agent how to install agent-browser. Pointing to the install command is the tool's declared core purpose, so the behavior is not undeclared. The package is a vercel-labs CLI.
Coverage gaps 4
Parts of the artifact the static analysis could not fully examine.
context:unanalyzable_binary binary content is only byte-scanned
test/fixtures/nextjs14-minimal/app/favicon.ico
no_tools_extracted MCP server target with no statically extractable tools/prompts/resources
package.json
request_unanswered request.0: instruction-surface.1/browser-eval-1: finding: citation not shown or quote not in it
invalid_judge_finding request.0
