fix: remove npx from allowed-tools to avoid Bash permission check error#708
Open
kangjinghang wants to merge 1 commit intovercel-labs:mainfrom
Open
fix: remove npx from allowed-tools to avoid Bash permission check error#708kangjinghang wants to merge 1 commit intovercel-labs:mainfrom
kangjinghang wants to merge 1 commit intovercel-labs:mainfrom
Conversation
The `npx` command is a shell function created by nvm, not an executable. When Bash permission checker validates `Bash(npx agent-browser:*)`, it attempts to parse this function, which triggers a security check error. Since agent-browser is typically installed globally, `npx` is not needed. Direct `agent-browser` invocation works fine and avoids this issue. Fixes issue where `/agent-browser` skill fails with: "Bash command permission check failed for pattern "!` characters"
Contributor
|
@kangjinghang is attempting to deploy a commit to the Vercel Labs Team on Vercel. A member of the Team first needs to authorize it. |
ctate
requested changes
Mar 12, 2026
Collaborator
ctate
left a comment
ctate
left a comment
There was a problem hiding this comment.
Thanks for the fix — root cause analysis is spot-on! Before merging, could you also remove Bash(npx agent-browser:*) from skills/slack/SKILL.md, skills/electron/SKILL.md, and skills/dogfood/SKILL.md? They have the same pattern and will hit the same error. Happy to merge once those are updated.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The
/agent-browserskill fails with:Root Cause
The
npxcommand is a shell function created by nvm (Node Version Manager), not an executable file. When the Bash permission checker validatesBash(npx agent-browser:*), it attempts to parse this shell function, which triggers a false positive security check.Solution
Remove
Bash(npx agent-browser:*)fromallowed-tools, keeping onlyBash(agent-browser:*). Since agent-browser is typically installed globally,npxis not needed and direct invocation works correctly.This fix resolves the permission check error while maintaining full functionality.