Supply chain
mediumContextual risklow confidenceThe skill's frontmatter authorizes the agent to run `npx agent-browser` with any arguments and no version pin, allowing the latest unpinned agent-browser package to be fetched and executed from the npm registry at runtime.
allowed-tools: Bash(agent-browser:*), Bash(npx agent-browser:*)
vector:instruction
Counter-argument considered
The strongest case against the finding is that the grant openly serves the skill's declared purpose of running agent-browser, but the pinned-official-registry-install carve-out requires a pin and this grant has none, so `npx agent-browser` with wildcard arguments executes whatever version npm serves at runtime; the behavior is openly declared (so undeclared fails) rather than neutralized, and the body's instruction to run agent-browser plus the frontmatter grant forms a concrete chain, so the low-severity finding stands.