ClawHub
Back to skill

Security audit

Playwright by Xiaomolong

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Playwright browser automation skill, with practical cautions around npm package pinning and sensitive browser artifacts.

Install only if you are comfortable using Playwright tooling from npm and automating the target sites. Prefer pinned package versions or a reviewed lockfile, avoid broad CI artifact uploads for authenticated or confidential workflows, and keep saved browser sessions temporary unless you intentionally need reuse.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:33
Finding

Unpinned npm Package Retrieval and Immediate Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:8 and SKILL.md:33
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

yaml
metadata: {"clawdbot":{"emoji":"P","requires":{"bins":["node","npx"]},"os":["linux","darwin","win32"],"install":[{"id":"npm-playwright","kind":"npm","package":"playwright","bins":["playwright"],"label":"Install Playwright"},{"id":"npm-playwright-mcp","kind":"npm","package":"@playwright/mcp","bins":["playwright-mcp"],"label":"Install Playwright MCP (optional)"}]}}
bash
npx @playwright/mcp --headless

Technical Analysis

The Skill identifies playwright and @playwright/mcp as dependencies without pinning either package to an audited version. Its quick-start command invokes npx @playwright/mcp directly.

If the package is not already installed locally, npx may retrieve the current package release from the configured npm registry and execute it immediately. Because no exact version or integrity value is specified, the effective executable payload can change after this Skill has been reviewed.

This is an insecure supply-chain boundary rather than evidence that the currently named packages are malicious. The risk arises because future package releases, registry compromise, account takeover, or registry-configuration manipulation could cause unaudited code to run.

Attack Path

  1. An attacker compromises a package publisher account, registry infrastructure, or the environment's npm registry configuration.

  2. The attacker makes a malicious package version available under a referenced package name or causes resolution to an attacker-controlled source.

  3. An agent or user follows the documented command:

    bash
    npx @playwright/mcp --headless

  4. npx retrieves the mutable package version because the dependency is not installed or pinned.

  5. npm lifecycle code or the package executable runs with the privileges of the invoking process.

  6. T ...[truncated 900 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin every executable dependency to an exact reviewed version:

    bash
    npx @playwright/mcp@<audited-exact-version> --headless

  2. Prefer installation through a committed package.json and lockfile rather than allowing npx to resolve a mutable release at invocation time.

  3. After controlled installation, use:

    bash
    npx --no-install playwright-mcp --headless

    This prevents npx from silently downloading a missing package.

  4. Verify lockfile integrity in CI and use npm ci rather than dependency commands that update resolution.

  5. Restrict package retrieval to an explicitly trusted registry and prevent untrusted project-level npm configuration from changing the registry.

  6. Review dependency provenance and npm lifecycle scripts before upgrades.

  7. Run browser tooling in an isolated environment with minimal filesystem access, restricted credentials, and constrained network permissions.

T09 · Insecure Skill Coding Practices

Note
Location
ci-cd.md:29
Finding

CI Upload of Browser Failure Artifacts May Disclose Sensitive Session Data

Content
View full analysis

Vulnerability Details

File Location: ci-cd.md:29-37 and ci-cd.md:102-106
Vulnerability Type: Insufficiently controlled upload of sensitive diagnostic artifacts
Risk Level: Low

Vulnerable Code

yaml
- uses: actions/upload-artifact@v4
  if: failure()
  with:
    name: playwright-report
    path: playwright-report/
    retention-days: 7
text
Use the official Playwright image or install browsers explicitly. Always keep traces and failure artifacts.

The related Playwright configuration enables additional browser captures:

typescript
use: {
  trace: 'on-first-retry',
  screenshot: 'only-on-failure',
  video: 'on-first-retry',
},

Technical Analysis

Playwright reports, traces, screenshots, and videos may contain sensitive information captured during authenticated browser workflows. Depending on the tested application and reporting configuration, artifacts can expose:

  • Entered form values
  • Personal or business data rendered in the browser
  • Sensitive URLs and query parameters
  • Authentication-related request metadata
  • Screenshots or videos of privileged application pages
  • Network requests and responses represented in traces

The example uploads the entire playwright-report/ directory whenever tests fail, without requiring artifact review, redaction, exclusion of sensitive tests, or validation of repository access controls.

The guidance also states that failure artifacts should always be retained. That broad recommendation is not appropriate for authentication, payment, medical, production, or other sensitive workflows. It conflicts with the claim in SKILL.md that traces, screenshots, and videos stay local because the documented CI configuration transfers reports to CI artifact storage.

Attack Path

  1. A Playwright test runs against an authenticated or data-bearing application.
  2. The test enters sensitive values or displays confidential information.
  3. The test fails or retries, causing Playwright to g ...[truncated 1273 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not recommend retaining or uploading all failure artifacts unconditionally.
  2. Disable traces, screenshots, and videos for workflows involving credentials, payment data, medical data, production systems, or other confidential content unless explicitly required.
  3. Upload only a reviewed allowlist of diagnostic files rather than the complete report directory.
  4. Add an automated sanitization step that removes secrets, cookies, authorization headers, sensitive URLs, and confidential page content before upload.
  5. Ensure test credentials are short-lived, minimally privileged, and isolated from production accounts.
  6. Restrict CI artifact access to personnel who require it and preserve the shortest practical retention period.
  7. Separate sensitive tests into jobs that do not publish browser artifacts.
  8. Document CI artifact storage as an external data destination in SKILL.md rather than stating that all such artifacts remain local.
  9. Pin CI actions to immutable commit digests where the repository's supply-chain policy requires stronger reproducibility.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (14)

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The skill instructs users to execute npx @playwright/mcp --headless without pinning a specific version. Because npx may fetch the latest package at execution time, a compromised publisher account, malicious release, or breaking upstream change could result in execution of unreviewed code on the user's machine. In a browser-automation skill, this is more dangerous because the tool may handle credentials, cookies, uploads, and arbitrary site interactions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
84% confidence
Finding

The command npx playwright test relies on whatever Playwright version is resolved at runtime rather than an explicitly reviewed version in the skill itself. If Playwright is not already installed locally, npx can download and execute the latest package, creating supply-chain risk and non-reproducible behavior, though this is somewhat less severe than launching an MCP server directly. The surrounding skill context increases exposure because users may run these commands in sensitive repositories and CI environments.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
84% confidence
Finding

The unpinned npx playwright test --headed command carries the same supply-chain and reproducibility risk as other unpinned npx playwright examples. A malicious or compromised upstream release could execute arbitrary code locally, and headed runs may occur on developer workstations with access to more secrets and session state. The skill's browser-oriented context makes this moderately dangerous because it encourages execution in interactive environments.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
84% confidence
Finding

The command npx playwright test --trace on is unpinned and may cause npx to fetch and execute an arbitrary newer package version. This introduces supply-chain risk and can be especially sensitive because trace-enabled test runs may capture application state, credentials, and internal URLs while running code obtained dynamically. The skill context does not make the behavior malicious, but it does increase the consequences if the package source is compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

The npx playwright codegen https://example.com example is also unpinned, so npx may install and run whatever current Playwright release is available at execution time. While code generation itself is a legitimate workflow, it still grants downloaded code execution on the local machine and opens a browser session, making a compromised upstream package a meaningful risk. In this skill, that risk is amplified by the expectation of interacting with real sites and potentially authenticated sessions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.