Skyvern: Automate Browser Tasks With AI Vision (GitHub, Scanned)

Skyvern automates work in a web browser by looking at the page the way a person does. Instead of a script full of CSS selectors that breaks when a site changes its layout, it gives a vision-capable language model a screenshot and the page structure, and lets it decide what to click, type and select to reach a goal you describe, such as filling in a form, downloading invoices from a portal or getting a quote.

There are three ways to use it. As a Python or TypeScript SDK it extends Playwright, so page.click can take a prompt like Click the green Submit button, and page.extract returns structured data matching a schema. As a local server it comes with a web UI and a no-code workflow builder that chains tasks, loops, data extraction and file downloads, with logins, two-factor codes and credentials handled through built-in integrations. And there is a managed cloud version from the same team.

It is AGPL-3.0, with about 23,200 stars, at v1.0.56 when scanned. The anti-bot measures used in the cloud version are not part of the open source code.

• Repository: github.com/Skyvern-AI/skyvern
• Licence: AGPL-3.0 (GNU Affero General Public License v3.0)
• Language: Python. Stars: 23.2K. Forks: 2,203. Last push: Oct 22, 2026.
• Scan: safe, Oct 22, 2026, commit 73e49ce

Who it is for

Operations teams with repetitive browser work across sites that have no API, developers who already use Playwright and want AI fallbacks, and builders of agents that need to act on real websites.

Getting started

1. Install the server and web UI (Python 3.11 to 3.13)

pip install "skyvern[all]"

2. Run the guided setup: picks your LLM provider and starts everything

skyvern quickstart

3. Open the web UI

open http://localhost:8080

The local setup stores its data in SQLite at ~/.skyvern/data.db by default; Docker Compose and Postgres are options. Every step calls a vision model, so long workflows add up on a paid API. Set SKYVERN_TELEMETRY=false before starting to turn off usage statistics.

Safety scan

We cloned Skyvern-AI/skyvern at commit 73e49ce on Oct 22, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• No secrets and no committed binaries across 5,595 files and about 1.8 million lines of Python and TypeScript.
• The pattern hits are explained: install.sh documents the project's own installer at install.skyvern.com and itself downloads before executing rather than piping into a shell, two Dockerfiles install uv, and the two exfiltration-host hits are error messages telling users not to use webhook.site or requestbin.com as webhook targets. Five very long lines are a bundled browser extension script and test fixtures.
• The README states that basic usage statistics are collected by default, with SKYVERN_TELEMETRY=false to opt out.
• 55 known advisories (3 critical), 38 of them in uv.lock. The criticals are Pillow image-decoding bugs; Skyvern mostly decodes its own browser screenshots. The rest are in the frontend and TypeScript SDK build tooling.
• 13 workflows. One uses pull_request_target to sync to the cloud repository and does not check out the pull request; all 15 third-party actions are pinned to commits. Security policy, licence and contributing guide present; no Dependabot or CodeQL.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: Python 1.3M, TypeScript 417.1K, JSON 95.4K, Markdown 32.6K, JavaScript 18.9K, YAML 5,013.

Questions

Is Skyvern free?

The open source version is free to self-host under the AGPL-3.0 licence; you pay for the language model calls it makes, or nothing with a local vision model. Skyvern Cloud is a paid managed service with extras such as anti-bot handling and parallel runs.

How is Skyvern different from browser-use?

Both let an AI drive a browser. browser-use is a Python library for agents. Skyvern adds a server with a web UI and a no-code workflow builder, credential and two-factor handling, and a Playwright-compatible SDK where AI is a fallback for ordinary selectors, so it leans more towards repeatable business workflows.

Which models does Skyvern work with?

Any provider with a vision-capable model that its setup supports, including OpenAI, Anthropic, Google Gemini, Azure, Bedrock and OpenRouter, plus local models through Ollama or an OpenAI-compatible server. Larger vision models are noticeably more reliable on complex sites.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.