vercel-sandbox

Pass

Audited by Gen Agent Trust Hub on Apr 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The provided code patterns use sandbox.runCommand to execute shell commands within ephemeral microVMs, including the use of sudo dnf for installing system dependencies and npm/npx for setting up automation tools.
  • [EXTERNAL_DOWNLOADS]: Facilitates the installation of the @vercel/sandbox package and the agent-browser tool from official package registries.
  • [PROMPT_INJECTION]: The skill implements a pattern for processing external web content (via URLs) which constitutes an indirect prompt injection surface. Evidence: 1. Ingestion points: The url parameter in functions such as screenshotUrl and snapshotUrl in SKILL.md. 2. Boundary markers: No explicit delimiters or instructions are provided to the agent to distinguish between its instructions and the data being processed. 3. Capability inventory: The sandbox environment allows for shell command execution, file system access, and complex browser interactions. 4. Sanitization: No sanitization of the external page content is performed before processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 17, 2026, 01:58 AM