Skyvern — agentic threat model

Uses LLM and vision models to interpret web pages. Highly vulnerable to adversarial visual elements or text on target websites (indirect prompt injection) that can reprogram the agent's goal during a live session.

Not certain from the listing — No explicit details are provided regarding RAG, vector databases, or training data operations, though it dynamically processes live DOM and visual data from external web pages.

Executes multi-step browser workflows. Vulnerable to tool misuse where an attacker manipulates the browser automation tool to perform unauthorized actions (e.g., clicking malicious links or submitting forms) via prompt injection.

Supports cloud or self-hosted deployment. Operating live browser sessions introduces significant infrastructure risks, such as container escape or host compromise, if the browser environment is not strictly sandboxed.

Not certain from the listing — There is no mention of built-in guardrails, real-time monitoring, or logging mechanisms to detect and block anomalous or malicious browser actions.

Handles credentials and authenticated web sessions. This introduces severe risks of credential theft, session hijacking, and unauthorized data exfiltration if security policies and secure storage are not strictly enforced.

Exposes browser control to other agents via an MCP server. This creates a significant risk of agent-to-agent trust abuse, where a compromised or rogue downstream agent could exploit Skyvern to perform malicious web actions.