Playwright Scraper Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:33 AM UTC
• Version: 1.0.0

Overview

This is a disclosed Playwright scraping skill, but it weakens Chromium sandboxing while opening arbitrary websites, which creates a real host-risk concern.

Install only if you trust the publisher and will run it in a restricted environment. Avoid using the stealth scripts on untrusted or attacker-controlled URLs unless Chromium sandboxing is enabled or the whole skill is isolated in a container/VM, and review saved screenshots or HTML because they may contain sensitive page content.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/playwright-stealth.js:42

Finding

Chromium Sandbox Disabled While Processing Arbitrary Remote Content

Content

View full analysis

Vulnerability Details

File Location: scripts/playwright-stealth.js:42-49; scripts/smzdm-scraper.js:15-21
Vulnerability Type: Browser isolation failure caused by unsafe launch configuration
Risk Level: High

Vulnerable Code

scripts/playwright-stealth.js:42-49:

javascript

const browser = await chromium.launch({
    headless: headless,
    args: [
        '--no-sandbox',
        '--disable-setuid-sandbox',
        '--disable-blink-features=AutomationControlled',
        '--disable-features=IsolateOrigins,site-per-process',
    ],
});

scripts/smzdm-scraper.js:15-21:

javascript

const browser = await chromium.launch({
  headless: false,
  args: [
    '--disable-blink-features=AutomationControlled',
    '--disable-dev-shm-usage',
    '--no-sandbox',
  ]
});

Technical Analysis

Both scripts launch Chromium with its operating-system sandbox disabled. The stealth script additionally disables site and origin process isolation through --disable-features=IsolateOrigins,site-per-process.

These settings are not required for the declared web-scraping or anti-detection functionality. Because the scripts accept a target URL from the command line, they can process arbitrary attacker-controlled webpages. The Chromium sandbox and process isolation boundaries provide defense in depth when a browser renderer is compromised. Disabling them makes a browser vulnerability substantially more likely to expose the host environment directly.

The code does not itself contain a browser exploit. Successful host compromise would require a vulnerability affecting the installed Chromium version or another browser component. Nevertheless, explicitly removing the relevant containment controls unnecessarily increases the impact of such a vulnerability.

Attack Path

1. An attacker supplies or persuades the user or agent to scrape an attacker-controlled URL.
2. The Skill launche ...[truncated 1223 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove --no-sandbox and --disable-setuid-sandbox from all Chromium launch configurations.
2. Remove --disable-features=IsolateOrigins,site-per-process unless a documented, security-reviewed compatibility requirement exists.
3. Run Chromium as a non-root user with its standard sandbox enabled.
4. If a deployment environment cannot support Chromium's sandbox, require an explicit opt-in rather than disabling it by default.
5. For exceptional unsandboxed deployments, place the complete Skill inside a separately hardened container or virtual machine with:
   • A non-root user.
   • A read-only root filesystem.
   • No host filesystem mounts containing credentials.
   • Dropped Linux capabilities.
   • Seccomp and AppArmor or SELinux enforcement.
   • Restricted outbound and internal network access.
   • Strict CPU, memory, process, and execution-time limits.
6. Validate allowed URL schemes and consider an outbound destination policy to prevent navigation to local files, loopback services, link-local metadata endpoints, and private network services.
7. Keep Playwright and its bundled Chromium version patched and regularly test that the browser sandbox remains active.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:87

Finding

Unpinned External Skill Is Installed and Executed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:87-95
Vulnerability Type: Mutable third-party dependency installation and execution
Risk Level: Medium

Vulnerable Code

bash

# Install deep-scraper skill
npx clawhub install deep-scraper

# Use it
cd skills/deep-scraper
node assets/youtube_handler.js "https://www.youtube.com/watch?v=VIDEO_ID"

Technical Analysis

The Skill documentation directs users to install a separately maintained external Skill by name and then execute one of its JavaScript files. The command does not pin an immutable version, commit, or content digest, and the documented workflow does not perform integrity or provenance verification.

Consequently, the code that ultimately executes can change after this package has been audited. A malicious package update, compromised publisher account, registry compromise, or package-name ownership change could cause future installations to contain behavior not represented in this repository.

This path is optional and is not automatically triggered by the audited scripts. Exploitation requires a user or agent to follow the YouTube transcript instructions.

Attack Path

1. An attacker compromises the external Skill's publisher account or distribution channel, or publishes a malicious update under the referenced package identity.
2. A user or agent follows SKILL.md and runs npx clawhub install deep-scraper.
3. The installer retrieves the current mutable package rather than a previously audited immutable release.
4. The user or agent runs node assets/youtube_handler.js.
5. The substituted handler executes arbitrary JavaScript with the privileges of the invoking account.
6. Malicious code can access resources available to that account or retrieve and execute further payloads.

Impact Assessment

If the external package is compromised, its JavaScript can obtain the same privileges as the user or agent executing it. Poten ...[truncated 556 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the unrelated external installation instructions from this Skill, or clearly separate them as an optional, independently reviewed integration.
2. Pin the external Skill to a specific audited version or immutable commit.
3. Verify a cryptographic digest or signed provenance record before execution.
4. Require explicit user confirmation before downloading or running any third-party Skill.
5. Document the external package's publisher, expected source repository, version, and integrity value.
6. Review the downloaded package before executing its scripts, including its installation hooks and transitive dependencies.
7. Execute optional third-party handlers in a restricted non-root environment with minimal filesystem and network access.
8. Prefer implementing the required transcript functionality through a reviewed library already covered by this project's lockfile and dependency controls.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (41)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description emphasizes anti-bot protection and successful use on complex protected sites, but the supplied code implements only basic Playwright navigation and extraction. It launches Chromium, visits a URL, waits, reads page text and metadata, and optionally takes a screenshot. There are no stealth plugins, proxy/user-agent rotation, CAPTCHA handling, challenge solving, cookie/session management, or other anti-bot mechanisms. In fact, the file header explicitly says it is for general dynamic websites with no anti-crawling protection. This is a material description-versus-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The code generally aligns with the broad claim of being a Playwright-based scraper with anti-bot/stealth behavior: it uses Playwright Chromium, modifies browser fingerprinting signals, and scrapes page content. However, the implementation is materially narrower and somewhat different from the declared description. It is a dedicated SMZDM scraper with a default SMZDM URL and site-specific extraction selectors, not a clearly general-purpose OpenClaw scraping skill. It also performs undeclared resource access by saving a screenshot file locally and requests geolocation permission even though the declared permissions are empty. These are enough to count as a description-behavior mismatch, though the core scraping/anti-bot theme is still consistent.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md

| **Cloudflare Protected** | High | **Playwright Stealth** ⭐ | `scripts/playwright-stealth.js` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md

| **Cloudflare Protected** | High | **Playwright Stealth** ⭐ | `scripts/playwright-stealth.js` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md

| **Cloudflare Protected** | High | **Playwright Stealth** ⭐ | `scripts/playwright-stealth.js` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

md

| **Cloudflare Protected** | High | **Playwright Stealth** ⭐ | `scripts/playwright-stealth.js` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

md

| **Cloudflare Protected** | High | **Playwright Stealth** ⭐ | `scripts/playwright-stealth.js` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

md

| **Cloudflare Protected** | High | **Playwright Stealth** ⭐ | `scripts/playwright-stealth.js` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

md

| **Cloudflare Protected** | High | **Playwright Stealth** ⭐ | `scripts/playwright-stealth.js` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.

md

| **Cloudflare Protected** | High | **Playwright Stealth** ⭐ | `scripts/playwright-stealth.js` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.

md

| **Cloudflare Protected** | High | **Playwright Stealth** ⭐ | `scripts/playwright-stealth.js` |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · test.sh (reported line 43)May include surrounding context.

sh

echo ""

# 清理
rm -f /tmp/test-*.json screenshot-*.png

echo "✅ 所有測試通過！"

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The installation guide tells users to run npx playwright install chromium without pinning the package version. If playwright is not already installed locally or if dependency resolution pulls an unexpected version, users may execute code from an unintended package version, increasing supply-chain risk during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

This command again invokes npx playwright without a pinned or strictly local version, which can cause npx to fetch and run a package version that is not controlled by the project. In an installation document, that creates a realistic supply-chain execution path if a malicious or compromised package/version is resolved.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The repeated unpinned npx playwright installation instruction preserves the same risk: executing package-managed code during setup without forcing a known-good local version. Because this is presented as routine troubleshooting guidance, users may run it directly, making exploitation via package/version confusion more plausible.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README explicitly promotes stealth scraping and anti-bot evasion techniques such as hiding navigator.webdriver, spoofing a realistic user agent, and simulating human behavior, but gives no warning about legal, contractual, or policy risks. In skill context, this makes misuse more likely by normalizing bypass behavior without guardrails, especially for protected sites like Cloudflare-backed targets.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README explicitly promotes stealth scraping, anti-bot evasion, screenshots, and HTML saving, but omits any warning about legal restrictions, privacy exposure, credential/session capture, or sensitive-data retention. In this skill context, those capabilities materially increase the chance of misuse against protected sites and can lead users to collect or store personal or confidential information without safeguards.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill advertises executable scripts and environment-variable-driven behavior but declares no explicit tool scope or permissions. That makes its runtime capabilities opaque to users and reviewers, increasing the chance of unexpected filesystem or environment access when the skill is used.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

Using npx playwright without pinning a version creates supply-chain risk because the installed package may change over time or resolve unexpectedly in different environments. A compromised or breaking upstream release could execute unreviewed code during installation or runtime.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly promotes anti-bot evasion techniques such as hiding automation markers, using realistic user agents, random delays, and possibly proxies, but does not warn about policy, legal, privacy, or detection implications. In context, this is more dangerous because the skill is specifically positioned for bypassing protections on defended sites, increasing misuse potential and operational risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.