Web Automation Runner
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's stated purpose (Playwright-based web automation) matches its instructions, but the runtime guidance is very broad (navigate any URL, run arbitrary JS, save artifacts) while providing no detail about how Playwright/Chromium are provided or how network/sandboxing is enforced — this gap and the broad capabilities create risk and incoherence you should review before installing.
This skill outlines powerful browser automation but leaves key runtime details unspecified. Before installing, ask: (1) Does the platform already provide Playwright + Chromium, or will this skill need to install them? (2) Where will the automation run (isolated sandbox, container, or a shared environment)? Can network access be restricted to avoid contacting internal/intranet hosts? (3) How are artifacts and logs stored and who can access the workspace files (screenshots, CSV/JSON)? (4) Never supply high-value credentials (banking, corporate SSO) unless you trust the execution environment and have explicit guarantees about no exfiltration; prefer test accounts or read-only API tokens. (5) Request the author to limit or vet arbitrary page JS execution and to document safety controls (rate limits, allowed domains, data retention). Given these gaps and the broad capability to access arbitrary URLs and run arbitrary JS, treat the skill as suspicious until you confirm dependency handling and runtime isolation.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
No visible risk-analysis findings were reported for this release.