FastPlayWright Skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:07 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent browser-automation helper, but it asks users to run a mutable third-party MCP package with broad browser authority and limited safety scoping.

Review this before installing. Pin the MCP package to a specific trusted version if possible, run it with minimal filesystem and browser-profile access, and avoid using it on logged-in or high-value sites unless you explicitly approve state-changing actions and know where screenshots or PDFs will be saved.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:27

Finding

Unpinned Third-Party Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27–28
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code:

json

"command": "npx",
"args": ["@tontoko/fast-playwright-mcp@latest"]

Technical Analysis

The recommended MCP configuration invokes npx with the mutable @latest tag for the third-party package @tontoko/fast-playwright-mcp. When the package is not already available locally, npx can retrieve it from the configured npm registry and execute its package entry point.

Because neither an exact version nor artifact integrity is specified, the code executed by users may differ from the code reviewed during this audit. A compromised publisher account, registry compromise, or malicious future release could therefore introduce arbitrary behavior without requiring changes to this repository.

Attack Path

1. An attacker compromises the package publisher, publishing pipeline, registry entry, or another relevant supply-chain component.
2. The attacker publishes a malicious release that becomes the package's latest version.
3. A user applies the MCP configuration documented in SKILL.md.
4. npx resolves and downloads the mutable @latest package release.
5. The malicious package executes locally as the user running the MCP server.
6. The package can perform actions permitted by that user's operating-system account and any capabilities exposed to the MCP process.

Impact Assessment

Successful exploitation could result in arbitrary code execution with the privileges of the user launching the MCP server. Depending on the execution environment, this may expose accessible local files, environment variables, browser data, network resources, or credentials available to that account. The malicious process could also abuse the intended browser-automation functionality.

The exact impact is constrained by the operating-system permissio ...[truncated 258 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with an exact, reviewed package version, for example @tontoko/fast-playwright-mcp@X.Y.Z.
2. Use a lockfile and a deterministic installation workflow where the surrounding MCP platform supports them.
3. Verify package provenance, publisher identity, signatures or attestations, and registry integrity before deployment.
4. Record and validate the expected package artifact integrity hash in the installation process where supported.
5. Review each dependency update before changing the pinned version; use automated vulnerability and supply-chain scanning as an additional control.
6. Run the MCP server in a sandbox or container with minimal filesystem access, restricted network egress, no unnecessary credentials, and a dedicated low-privilege account.
7. Avoid exposing sensitive host directories, environment variables, browser profiles, or authentication material to the MCP process unless explicitly required.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill advertises browser automation for form automation, navigation flows, and general web tasks, but does not warn that these actions operate against real sites and can submit forms, trigger purchases, change account state, or perform other irreversible side effects. In an agent context, omission of this warning increases the chance that a user or downstream model invokes the skill in unsafe situations without confirmation gates.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The examples demonstrate saving screenshots to local files without warning that artifacts are written to local storage and may contain sensitive page contents, account data, or internal application information. In agent environments, silent file creation can create privacy, retention, and workspace contamination risks, especially when screenshots are taken from authenticated sessions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.