Playwright Service
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's stated purpose (web screenshots/scraping) matches its instructions, but it directs arbitrary page data and screenshots to an undocumented private IP and a hard-coded Telegram group — a potential data-exfiltration/privacy risk and provenance gap.
This skill will send any URL you ask it to fetch (and the fetched content/screenshots) to the hard-coded host http://192.168.0.9:3000 and will post screenshots to a hard-coded Telegram group. Before installing, verify who runs that 192.168.0.9 service and whether it is trusted (owner, retention, access controls), and confirm you want screenshots posted to the specified Telegram group. If this is intended to call an internal, trusted service, document that provenance in the skill metadata; otherwise avoid installing or modify the skill to use a vetted public service or a service you control. Additional useful info to change this assessment: an authoritative homepage/source for the skill, confirmation that the endpoint is operated by a trusted team, and explicit documentation of what data is logged/retained and who can access the Telegram group.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
No VirusTotal findings
Risk analysis
No visible risk-analysis findings were reported for this release.