Run agent-browser + Chrome inside Vercel Sandbox microVMs for browser automation from any Vercel-deployed app. Use when the user needs browser automation in a Vercel app (Next.js, SvelteKit, Nuxt, Remix, Astro, etc.), wants to run headless Chrome without binary size limits, needs persistent browser sessions across commands, or wants ephemeral isolated browser environments. Triggers include "Vercel Sandbox browser", "microVM Chrome", "agent-browser in sandbox", "browser automation on Vercel", or any task requiring Chrome in a Vercel Sandbox.
Risky behavior the analysis could not rule out.
bootstrapSandbox runs dnf system package installation with sudo inside the sandbox microVM, elevating to root within the VM at request time to install Chromium dependencies.
sudo dnf install -y --skip-broken
What the analysis could not settle from the code alone.
Candidates the review stage examined and rejected, kept for transparency.
SKILL.md instructs the agent to run the bundled one-time setup script examples/environments/scripts/create-snapshot.ts via npx tsx, which provisions a Vercel Sandbox snapshot using VERCEL credentials, and only the script's docstring (not its body) is included in the reviewed evidence.
npx tsx examples/environments/scripts/create-snapshot.ts
Provisioning a sandbox snapshot with VERCEL credentials is the skill's own declared workflow (declared claim 'Run this once, then set the environment variable:' and the Authentication section), and the shipped script's visible body merely validates credentials and calls the shown createSnapshot function, whose body provisions exactly what is documented; the docstring-only caveat is superseded by the shown body units.
The Example section instructs the agent to consult the unshipped directory examples/environments/ in the agent-browser repo, which per detector resolution contains hidden files such as .env.example and a sandbox snapshot creation script, exposing the agent to unvetted external executable content the artifact itself does not ship.
See `examples/environments/` in the agent-browser repo for a working app with the Vercel Sandbox pattern, including a sandbox snapshot creation script
The premise that examples/environments/ is unshipped, unvetted external content is false: the directory ships with this artifact and its shown files are the artifact's own benign snapshot helper script and a comment-only .env.example with empty placeholders, so the cross-reference exposes no unvetted executable content.
Undeclared residue: the example UI embeds outbound references to vercel.com (a deploy-button link to the vercel-labs/agent-browser repository plus a vercel.com/button badge image) that the skill's declared browser-automation purpose does not cover; it is user-facing deploy scaffolding, not shown to transmit local data off-host.
href=
The flagged vercel.com references are a static deploy-button hyperlink and badge image in the example UI's header; no shown code path transmits local data off-host, so the EXFIL harm is absent even though the URL is undeclared residue.
bootstrapSandbox installs the unpinned npm package agent-browser globally and then runs npx agent-browser install inside the Vercel Sandbox microVM, executing freshly fetched code at runtime whenever no snapshot ID is configured (bootstrap is invoked from createSandbox and createSnapshot).
await sandbox.runCommand(
Installing and initializing agent-browser is the skill's declared core capability ('Run agent-browser + Chrome inside Vercel Sandbox microVMs'), it executes inside the isolated ephemeral microVM rather than on the host, and SKILL.md openly states each run installs agent-browser.
Undeclared residue: the example's rate limiter reads the KV_REST_API_TOKEN (with KV_REST_API_URL) environment credential server-side to authenticate to its configured Upstash/Vercel KV instance; rate limiting is not part of the declared browser-automation purpose and no shown code sends the credential anywhere other than the configured Redis endpoint.
const token = process.env.KV_REST_API_TOKEN;
The credential is read and passed only to the Redis client for the URL configured from the same environment pair, with no other sink; using a service's own env credential to authenticate to that service is not credential theft or exfiltration.
SKILL.md instructs running 'npx tsx examples/environments/scripts/create-snapshot.ts', which fetches the unpinned tsx runner from the npm registry when absent and executes it on the host where dotenv-loaded credentials such as VERCEL_TOKEN are in scope.
npx tsx examples/environments/scripts/create-snapshot.ts
The exact command is openly declared in the skill body as its documented snapshot workflow, the executed script is shipped and its shown body only validates credentials before calling the shipped createSnapshot function, and tsx is the conventional official-registry runner fetched by standard npx — no concealed or unvetted payload.
The skill text points the agent at the examples/environments/ directory, which the detector reports resolves to hidden-dot files such as .env.example and favicon.ico, inviting the agent to load files outside the sections shown for review, though the reference itself is an open cross-reference to a shipped example app consistent with the declared purpose.
See `examples/environments/` in the agent-browser repo for a working app with the Vercel Sandbox pattern
The referenced dotfiles ship with the artifact and .env.example contains only commented placeholders and empty values, so there is no secret or sensitive content to reconnoiter; the reference is an open cross-reference consistent with the declared browser-automation purpose.
Parts of the artifact the static analysis could not fully examine.
context:unanalyzable_binary binary content is only byte-scannedcontext:unanalyzable_binary binary content is only byte-scannedcontext:manifest_unparseable yaml: YAML node count exceeds 20000unanalyzable_binary binary content is only byte-scannedparse_error tree-sitter tsx parse has errors; extraction may be partialrequest_unanswered request.0: declared-vs-actual.3/req-lib-agentsandbox: finding: no valid finding cites the answer's evidencerequest_unanswered request.0: behavior-chains.1/req-snapshot-body: finding: no valid finding cites the answer's evidenceinvalid_judge_finding request.0