Why this verdict
- inconclusive: gap invalid_judge_finding
- inconclusive: gap ledger_finding_without_valid_finding
- inconclusive: judge runs incomplete or invalid
- inconclusive: ledger 21/24 checks satisfied
Security findings 0
No individual findings recorded
The inconclusive verdict rests on the coverage gaps below; 2 candidate findings were refuted on review.
Refuted findings 2
Candidates the review stage examined and rejected, kept for transparency.
Supply chain
highRefutedlow confidenceThe skill frontmatter grants the agent unrestricted Bash permission to invoke `npx agent-browser` with any arguments, which resolves and executes the latest agent-browser package from npm at runtime without a version pin.
allowed-tools: Bash(agent-browser:*), Bash(npx agent-browser:*), Bash(vc:*), Bash(vercel:*)
Why it was refuted
The allowed-tools grant is fully visible frontmatter scoped to agent-browser/vc/vercel, and the declared description names agent-browser as the skill's tool, so the permission is the declared core capability (and broad-permissions carve-out), not concealed or contradictory behavior; the unpinned npx resolution is generic packaging hygiene of the wrapped tool, not artifact harm.
Privilege escalation
highRefutedhigh confidenceSKILL.md instructs the agent to enable Vercel Protection Bypass for Automation by running 'vc project protection enable <project> --protection-bypass' with a static secret and to send it as a bypass header that creates a reusable _vercel_jwt cookie, a permission-bypass change to the deployment's access control that weakens Deployment Protection if exercised, gated in the text only by a requirement to obtain explicit human authorization first.
vc project protection enable <project> --protection-bypass
Why it was refuted
The command is the skill's explicitly declared, vendor-documented fallback, neutralized by stated mitigations (explicit human authorization first, prohibition on disabling protection or making the deployment public, dedicated rotatable secret); it does not contradict D15, which forbids browser-automation access-control changes, because this is a CLI action the text itself reserves for post-approval use.
Coverage gaps 9
Parts of the artifact the static analysis could not fully examine.
context:unanalyzable_binary binary content is only byte-scanned
docs/src/app/favicon.ico
context:unanalyzable_binary binary content is only byte-scanned
examples/environments/app/favicon.ico
context:unanalyzable_binary binary content is only byte-scanned
packages/dashboard/src/app/favicon.ico
context:manifest_unparseable yaml: YAML node count exceeds 20000
pnpm-lock.yaml
ledger_finding_without_valid_finding run 1: instruction-surface.0 SRC:1163a593183652c3
ledger_finding_without_valid_finding run 1: behavior-chains.0 SRC:60c3e55106cd92d5
ledger_finding_without_valid_finding run 1: behavior-chains.0 SRC:1163a593183652c3
invalid_judge_finding instruction-surface.0
invalid_judge_finding behavior-chains.0
