T09 · Insecure Skill Coding Practices
Error
- Location
scripts/playwright-stealth.js:47- Finding
Unrestricted Browser Navigation with Chromium Security Isolation Disabled
- Content
View full analysis
- Remediation
View remediation
Security audit
Playwright Scraper Skill 1.2.0
Security checks for vulnerabilities and agentic risk
Overview
This is a real Playwright scraping skill, but it promotes anti-bot bypass and runs arbitrary URLs in a weakened browser with broad file-output controls.
Install only if you are comfortable running a local browser scraper against sites you are authorized to access. Avoid using it on private/internal URLs, authenticated pages, or sensitive accounts unless isolated. Run it in a container or low-privilege environment, do not pass arbitrary SCREENSHOT_PATH values from untrusted input, treat saved screenshots/HTML as potentially sensitive, and pin/review any optional third-party scraper before use.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/playwright-stealth.js:25- Finding
Caller-Controlled Output Paths Permit Arbitrary File Overwrite
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:86- Finding
Documentation Executes an Unpinned Third-Party Skill Through npx
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (38)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The description emphasizes anti-bot protection and operation on complex protected sites, which is the core claimed capability. However, the code is a minimal Playwright script: it opens a page, waits, extracts basic text and metadata, and optionally takes a screenshot. There is no evidence of anti-bot handling such as stealth measures, header/user-agent management, proxy/cookie/session handling, challenge solving, retry logic, or site-specific workflows. In fact, the inline comments explicitly say it is for general dynamic websites with no anti-crawling protection. That makes the declared purpose materially overstated relative to the actual behavior.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **Cloudflare Protected** | High | **Playwright Stealth** ⭐ | `scripts/playwright-stealth.js` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **Cloudflare Protected** | High | **Playwright Stealth** ⭐ | `scripts/playwright-stealth.js` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **Cloudflare Protected** | High | **Playwright Stealth** ⭐ | `scripts/playwright-stealth.js` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **Cloudflare Protected** | High | **Playwright Stealth** ⭐ | `scripts/playwright-stealth.js` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **Cloudflare Protected** | High | **Playwright Stealth** ⭐ | `scripts/playwright-stealth.js` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **Cloudflare Protected** | High | **Playwright Stealth** ⭐ | `scripts/playwright-stealth.js` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **Cloudflare Protected** | High | **Playwright Stealth** ⭐ | `scripts/playwright-stealth.js` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **Cloudflare Protected** | High | **Playwright Stealth** ⭐ | `scripts/playwright-stealth.js` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **Cloudflare Protected** | High | **Playwright Stealth** ⭐ | `scripts/playwright-stealth.js` |
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The troubleshooting guidance advises manual login followed by cookie export/load for authenticated scraping, but gives no warning about the sensitivity of session cookies. Session cookies can grant account access without passwords, so normalizing their export/import materially increases the risk of credential theft, session hijacking, and unauthorized access if mishandled or logged.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh echo "" # 清理 rm -f /tmp/test-*.json screenshot-*.png echo "✅ 所有測試通過！"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The changelog explicitly promotes anti-bot evasion, recommends hiding browser automation fingerprints, and plans future CAPTCHA, cookie, and login-state features. In a scraping skill, this materially increases abuse potential by facilitating bypass of site defenses and collection from authenticated or restricted contexts without any warning about legal, privacy, or policy constraints.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README explicitly promotes stealth scraping and anti-bot evasion, including hiding automation signals and mimicking real users, but provides no warning about legal, policy, or account-risk implications. In a scraping skill, this increases the likelihood of misuse against protected services and normalizes bypassing access controls, making the documentation materially more dangerous than neutral browser automation guidance.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The README documents saving screenshots and full HTML without warning that these artifacts may contain session tokens, personal data, internal content, or other sensitive information. In a scraping tool context, encouraging storage of page captures without data-handling guidance raises confidentiality and retention risks, especially when used on authenticated or user-specific pages.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill documents use of environment variables that influence runtime behavior, but it does not declare any explicit tool scope or permissions boundaries. In an agent ecosystem, missing scope declarations can lead to overly broad execution assumptions and make it harder to enforce least privilege or review what the skill is allowed to access.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 91% confidence
- Finding
Using
npx playwrightwithout pinning a specific version creates a supply-chain and reproducibility risk because the resolved package version can change over time. That can introduce unexpected behavior or malicious upstream code into installations or runtime setup steps.- Content
Static analysis
No suspicious patterns detected.