ClawHub
Back to skill

Security audit

Playwright WS

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims, but users should treat the remote Playwright server and generated browser artifacts as sensitive.

Install only if you control or fully trust the Playwright WebSocket server. Avoid using it with sensitive authenticated pages unless the server, output directory, traces, and any storage-state files are protected. Pin dependency and Docker/npx versions if you need reproducible or higher-assurance use.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (23)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description is about browser automation using Playwright over a remote WebSocket server. The provided code does not perform any browser automation, networking, screenshots, PDF generation, or testing. Instead, it is a build/publishing utility that packages a local skill directory into an archive by reading files, recursively copying directories, invoking the system zip command, and cleaning up a temporary directory. This is a materially different primary purpose and involves undeclared local filesystem and process-execution capabilities unrelated to the stated skill behavior.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared purpose is browser automation with Playwright over a remote WebSocket connection, but the supplied code does not perform any browser automation, network/WebSocket activity, screenshot/PDF generation, or testing. Instead, it is a local build/packaging utility for creating .skill files from a directory. This is a materially different primary purpose and introduces undeclared filesystem and process-execution behavior unrelated to the stated browser automation functionality.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding

The declared purpose describes operational browser automation functionality using Playwright over WebSocket. However, the supplied code does not perform browser automation, connect to a remote WebSocket server, generate screenshots/PDFs, or run browser tests directly. Instead, it checks for the existence of expected files and validates documentation text patterns. While some checks reference script filenames associated with the declared purpose, this chunk's actual behavior is primarily project structure and documentation validation, which is materially different from the declared runtime capability.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: js-yaml==3.14.2 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High
Category
Supply Chain
Confidence
80% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==1.1.12 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High
Category
Supply Chain
Confidence
80% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: browserslist==4.28.1 — 2 advisory(ies): CVE-2026-73088 (Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.); CVE-2026-73089 (Browserslist: Unbounded memory growth (no cache eviction) via distinct query res)

High
Category
Supply Chain
Confidence
80% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: flatted==3.3.4 — 2 advisory(ies): CVE-2026-32141 (flatted vulnerable to unbounded recursion DoS in parse() revive phase); CVE-2026-33228 (Prototype Pollution via parse() in NodeJS flatted)

High
Category
Supply Chain
Confidence
80% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: js-yaml==4.1.1 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High
Category
Supply Chain
Confidence
80% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This skill is explicitly designed for remote browser automation over WebSocket, which means visited URLs, page content, cookies, inputs, screenshots, and test interactions may be transmitted to and processed by remote infrastructure. The README presents this as a convenience feature but omits a clear warning about confidentiality, trust boundaries, and the risks of pointing agents at untrusted or third-party Playwright servers.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
84% confidence
Finding

The Docker example is flagged because it does not use a fully immutable image reference such as a digest, which can allow image contents to change over time if users adapt the pattern loosely. In a security-sensitive automation skill, relying on mutable container references increases supply-chain uncertainty and can lead to executing altered images with browser automation privileges.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The README instructs users to run npx playwright inside a Docker container without pinning the package version. Unpinned package resolution can cause users to execute unexpected or newly published code, reducing reproducibility and increasing supply-chain risk if the upstream package or dependency chain changes or is compromised.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · references/api-reference.md (reported line 35)May include surrounding context.

md
await page.click('button', { clickCount: 2 });  // Double click
await page.dblclick('button');

// Fill inputs
await page.fill('#email', 'user@example.com');
await page.fill('#email', '');  // Clear

Session Persistence

Medium
Category
Rogue Agent
Confidence
86% confidence
Finding

The example promotes loading and saving browser storage state to 'auth.json', which can preserve authenticated sessions, cookies, and other sensitive browser state. In a remote Playwright automation skill, this raises the risk of session theft, unintended privilege reuse, or leakage of persistent authentication material if the file is mishandled.

Content

Scanner excerpt · references/api-reference.md (reported line 167)May include surrounding context.

md
timezoneId: 'Europe/Berlin',
  geolocation: { latitude: 52.52, longitude: 13.405 },
  permissions: ['geolocation'],
  storageState: 'auth.json'  // Load saved state
});

// Save storage state

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Saved Playwright traces can include screenshots, DOM snapshots, network metadata, and interaction history, which may expose credentials, personal data, or proprietary application state. Because this skill is for remote browser automation and testing, trace files are especially likely to contain sensitive session material if created during authenticated workflows.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The script navigates a browser to a user-supplied URL over a remote Playwright WebSocket connection and writes a PDF to disk. While there is basic CLI usage and a success log, there is no explicit user-facing warning that page content and browsing activity are sent to a remote browser service or that a file will be created at the specified path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The screenshot and PDF examples write files locally and may capture sensitive page contents, including authenticated views or personal data, without any warning. In an agent setting, this can cause unintended local persistence of sensitive material and broaden exposure if output paths are shared, synced, or later exfiltrated.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @babel/core==7.29.0 — 1 advisory(ies): CVE-2026-49356 (@babel/core: Arbitrary File Read via sourceMappingURL Comment)

Low
Category
Supply Chain
Confidence
60% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: baseline-browser-mapping==2.10.0 — 1 advisory(ies): CVE-2026-45819 (baseline-browser-mapping process termination on invalid input causes denial of s)

Low
Category
Supply Chain
Confidence
60% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
91% confidence
Finding

The dependency uses a caret range (^1.40.0), which permits automatic installation of newer minor and patch releases rather than a single audited version. In a security-sensitive automation skill that controls a remote browser, this increases supply-chain risk because a compromised or breaking upstream release could be pulled into environments without explicit review.

Content

Scanner excerpt · package.json (reported line 26)May include surrounding context.

json
"url": "https://github.com/first-it-consulting/playwright-skill.git"
  },
  "dependencies": {
    "playwright": "^1.40.0"
  }
}

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The documentation encourages writing screenshots and PDFs to disk without warning that these artifacts may contain sensitive page content, tokens, personal data, or internal application state. In a browser automation skill, operators may use these examples against authenticated or private pages, making inadvertent data retention and disclosure plausible.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

SQP-3 applies to natural-language and config-like values in any file type. The example hard-codes a specific locale and timezone combination without stating that it is only an example or offering user choice, which could be interpreted as forcing a locale.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/package-for-clawhub.js:83

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/package-skill.js:72

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/test-runner.js:45