Refuted findings 10
Candidates the review stage examined and rejected, kept for transparency.
Persistence
criticalRefutedlow confidenceThe documented command redirects the Slack search-results snapshot (message content, senders, channels, timestamps) into the local file search-snapshot.txt, a workspace file write not declared in the skill description.
agent-browser snapshot -i > search-snapshot.txt
Why it was refuted
The documented step saves the search-results snapshot the task just captured so it can be parsed, plainly visible and serving the declared search/extract capability; a local data file write is not a persistence mechanism.
Persistence
criticalRefutedlow confidenceThe documented command redirects the conversation snapshot (user names, timestamps, message text, reactions) into the local file conversation.json, a workspace file write not declared in the skill description.
agent-browser snapshot --json > conversation.json
Why it was refuted
The step redirects the conversation snapshot to a JSON file for the structured extraction the declared capability describes, openly documented and non-persistent; the declared-core-capability carve-out applies.
Persistence
criticalRefutedlow confidenceThe documented command redirects the pinned-messages snapshot into the local file pins-snapshot.txt, a workspace file write not declared in the skill description.
agent-browser snapshot -i > pins-snapshot.txt
Why it was refuted
The pinned-messages snapshot redirect is an openly documented capture of command output for the review step that follows, instrumental to the declared extraction capability and not a persistence mechanism of any kind.
Persistence
criticalRefutedlow confidenceThe documented command redirects the full channel-list snapshot into the local file channels.json, a workspace file write not declared in the skill description.
agent-browser snapshot --json > channels.json
Why it was refuted
The channel-list snapshot redirect is the documented means of producing the evidence the declared channel-listing task requires, fully visible in the body and lacking any persistence mechanism, so the harm gate's carve-out for the declared core capability applies.
Persistence
criticalRefutedlow confidenceThe documented command redirects the full Slack accessibility-tree snapshot (channel names and metadata the task extracts) into the local file slack-snapshot.json, a workspace file write not declared in the skill description.
agent-browser snapshot --json > slack-snapshot.json
Why it was refuted
This is an openly documented example redirecting the snapshot command's own output into a workspace data file, which is the declared 'extract data' capability in action; no persistence mechanism (scheduled task, autostart, config hook) exists, so the harm gate's declared-core-capability carve-out applies.
Persistence
criticalRefutedlow confidenceThe documented command redirects the full Slack accessibility-tree snapshot (channel names, message content, user names, timestamps) into the local file output.json, a workspace file write not declared in the skill description.
agent-browser snapshot --json > output.json
Why it was refuted
The documented redirection saves the snapshot the workflow just produced for parsing, plainly shown in the body and instrumental to the declared extraction capability; it is an ordinary data-file write, not a persistence mechanism.
Persistence
criticalRefutedlow confidenceThe example bash script redirects the interactive Slack snapshot (workspace unread state) into the local file snapshot.txt, a workspace file write not declared in the skill description.
agent-browser snapshot -i > snapshot.txt
Why it was refuted
An example script saving the interactive snapshot to a local text file for its own summary step is visible documentation of the declared unread-check capability, not any persistence mechanism; the carve-out for the declared core capability applies.
Persistence
criticalRefutedlow confidenceThe example bash script redirects the expanded unread-channels snapshot into the local file unreads-expanded.txt, a workspace file write not declared in the skill description.
agent-browser snapshot -i > unreads-expanded.txt
Why it was refuted
The redirection captures the expanded unread list as workflow output inside a fully shown example script serving the declared unread-check capability; nothing is installed or persisted beyond a data file the script itself consumes.
Supply chain
mediumRefutedlow confidenceThe skill's frontmatter grants Bash permission for `npx agent-browser:*`, which can fetch and execute the agent-browser npm package at an unpinned latest version from the registry rather than a pinned local binary, an unpinned remote-code surface alongside the locally installed tool the declared purpose requires.
allowed-tools: Bash(agent-browser:*), Bash(npx agent-browser:*)
Why it was refuted
The npx entry is an openly declared permission in the standard allowed-tools frontmatter that no instruction in the shown skill body ever exercises (every documented command invokes the local agent-browser binary), so the alleged unpinned fetch-and-execute harm is unused-permission potential alone, which the broad-permissions-alone carve-out covers, and authorizing the automation tool the declared capability requires.
Supply chain
mediumRefutedlow confidenceThe skill frontmatter pre-authorizes Bash execution of 'npx agent-browser', which at invocation can download and execute an unpinned version of the agent-browser package from the npm registry (download-to-execute), even though all documented commands invoke only the locally installed 'agent-browser' binary.
allowed-tools: Bash(agent-browser:*), Bash(npx agent-browser:*)
Why it was refuted
The pre-authorization is itself the frontmatter declaration, stated openly and matching the declared browser-automation capability, and the shown skill units contain no command invoking npx (all documented commands call the local agent-browser binary), leaving only permission potential, which the broad-permissions-alone carve-out accepts.
