Manikantasai Playwright Automation

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:37 PM UTC
• Version: 1.0.0

Overview

The skill is mostly a browser-automation guide, but it recommends persistent passwordless root access for broad npx Playwright commands.

Review this skill before installing. Avoid the sudoers NOPASSWD rules, do not run unpinned npx commands as root, pin Playwright through a locked project dependency, and protect any screenshots, videos, downloads, cookies, tokens, or auth state files created during automation.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:303

Finding

Passwordless Root Access Through Broad npx Sudoers Rules

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 303-308
Vulnerability Type: Passwordless privilege escalation through an overly broad sudoers policy
Risk Level: High

Vulnerable Code

bash

## Sudoers Setup

For Playwright browser installation:

# /etc/sudoers.d/playwright
username ALL=(root) NOPASSWD: /usr/bin/npx playwright install-deps *
username ALL=(root) NOPASSWD: /usr/bin/npx playwright install *

Technical Analysis

The documented sudoers configuration grants the specified user persistent, passwordless permission to execute two npx command patterns as root. Both rules accept wildcard arguments, while npx is a package-resolution and execution utility rather than a narrowly scoped administrative binary.

The effective code executed by npx can be affected by the installed package version, npm configuration, package-resolution context, and package lifecycle or installation behavior. Granting root access to such a general package execution mechanism violates least privilege. The authorization also remains active across sessions until the sudoers entry is removed.

This issue becomes especially dangerous when combined with the unpinned dependency installation documented elsewhere in the file. A compromised Playwright release, npm configuration, package cache, or locally resolved package could cause package-controlled behavior to run with root privileges.

Attack Path

1. An administrator installs the recommended sudoers rules for a regular user.
2. An attacker compromises that user account or gains the ability to influence its Node/npm package-resolution environment.
3. The attacker introduces or causes resolution of package-controlled content through the local project, npm configuration, cache, or a compromised dependency release.
4. The attacker invokes a command matching one of the passwordless rules, such as sudo /usr/bin/npx playwright install ....
5. npx resolves ...[truncated 960 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the documented NOPASSWD sudoers rules and delete any deployed copies from /etc/sudoers.d/.
2. Do not grant elevated access directly to npm, npx, Node.js, shells, interpreters, or other general-purpose execution tools.
3. Install required operating-system dependencies once through a trusted administrator using reviewed, distribution-native package commands.
4. Prefer a prebuilt, isolated container image containing the required browser dependencies.
5. If delegated installation is unavoidable, create a root-owned wrapper that:
   • Uses fixed commands and fixed arguments.
   • Rejects all user-supplied options and environment variables.
   • Uses absolute executable and package paths.
   • Applies a sanitized environment and fixed working directory.
   • Does not perform dynamic npm package resolution.
6. Require authentication rather than NOPASSWD and limit authorization to the shortest practical period.
7. Pin and verify all packages before any privileged installation operation.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Playwright Installation Creates Mutable Supply-Chain Exposure

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13-24; package metadata at line 4
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash

## Installation

# Install Playwright
npm install -g playwright

# Install browsers (one-time, ~100MB each)
npx playwright install chromium
# Optional:
npx playwright install firefox
npx playwright install webkit

# For system dependencies on Ubuntu/Debian:
sudo npx playwright install-deps chromium

The package metadata also leaves the dependency version unspecified:

yaml

metadata: {"openclaw":{"emoji":"🎭","os":["linux","darwin","win32"],"requires":{"bins":["node","npx"]},"install":[{"id":"npm-playwright","kind":"npm","package":"playwright","bins":["playwright"],"label":"Install Playwright"}]}}

Technical Analysis

The installation instructions and package metadata request playwright without an exact version or integrity constraint. Consequently, two users following the same reviewed Skill at different times may download and execute different package contents.

Global npm installation can execute package lifecycle behavior with the installing user's privileges. Subsequent npx commands depend on the available package and npm resolution environment. No lockfile, checksum, integrity value, approved registry configuration, or exact package version is provided.

The issue does not establish that the current Playwright package is malicious. The risk is that the effective dependency payload remains mutable after this Skill has been audited. A future registry compromise, maintainer-account compromise, unexpected release, or manipulated npm resolution environment could substitute code not represented by the reviewed project files. Running the same workflow through sudo npx, as documented, can amplify the impact to root privileges.

Attack Path

1. A user follows the Skill's insta ...[truncated 1236 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin Playwright to an explicitly reviewed version, for example by using an exact version rather than an unbounded package name.
2. Use a project-local dependency instead of a global installation.
3. Commit and enforce a lockfile containing integrity hashes.
4. Use deterministic installation commands such as npm ci against the reviewed lockfile.
5. Configure an approved npm registry and validate package provenance or signatures where supported.
6. Perform dependency installation as an unprivileged user; never perform dynamic npm or npx resolution under sudo.
7. Scan pinned dependencies and update them through a controlled review process.
8. Consider distributing a prebuilt container image or verified artifact with fixed Playwright and browser versions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description claims this skill provides direct browser automation via the Playwright API and is more reliable than an MCP approach. The supplied code instead is explicitly an example wrapper for Playwright MCP usage, and even notes that it is only conceptual. It constructs and prints MCP tool-call payloads like browser_navigate, browser_click, browser_type, and browser_evaluate, but does not launch a browser or invoke Playwright directly. This is a material description-behavior mismatch because the primary implementation approach is the opposite of what is declared (MCP vs direct API), and the code does not actually carry out the advertised browser automation capabilities.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill documents shell-based installation and privileged commands, but it does not declare an explicit tool scope such as allowed-tools or permissions. In an agent ecosystem, missing scope boundaries can let a consumer invoke shell actions that were not clearly constrained, increasing the risk of unintended command execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly advertises extracting data, taking screenshots, generating PDFs, and recording videos, all of which can capture sensitive or regulated information, but it provides no privacy or data-handling warning. In an automation skill, omission of these warnings can lead users to collect, retain, or share sensitive content without adequate safeguards.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

Using 'npx playwright' without a pinned version makes execution depend on whatever package version resolves at runtime. That creates a supply-chain risk: a malicious or breaking upstream release could alter behavior or execute unintended code during install or invocation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

This unpinned 'npx playwright' browser install command relies on a mutable upstream package version. In practice, that weakens reproducibility and exposes users to supply-chain compromise or unexpected installer behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The Firefox install example also uses an unpinned 'npx playwright' reference, which means users may fetch different code over time. This is a classic dependency-hygiene weakness and can become a supply-chain attack path.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

The documentation recommends a sudo-based command to install browser system dependencies. Even though this is a setup step, normalizing root execution in a skill increases risk, especially when paired with a Node-based package tool that may download and run installation logic.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

npx playwright install webkit

For system dependencies on Ubuntu/Debian:

sudo npx playwright install-deps chromium

text

## Quick Start

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Running 'sudo npx playwright install-deps chromium' combines privilege escalation with an unpinned package resolution step. If the fetched package or install script is compromised, it could execute with elevated privileges and significantly increase system impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The authentication section includes hardcoded credentials, cookies, tokens, and persisted auth state without warning that these are secrets that should be protected. This can normalize insecure secret handling and lead to credential leakage through source control, logs, shared artifacts, or reused session files.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The sudoers example authorizes '/usr/bin/npx playwright install-deps *' without pinning a Playwright version, leaving root-executable behavior tied to mutable package resolution. This expands supply-chain risk into persistent privileged execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Granting passwordless sudo for '/usr/bin/npx playwright install *' is especially dangerous because it allows privileged execution of installation behavior from an unpinned package source. A compromised package, typo-squatted dependency, or unexpected CLI change could lead to root-level code execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The sample context configuration hard-codes locale 'ru-RU', timezone 'Europe/Moscow', and Moscow geolocation values. This is a natural-language policy concern because it imposes a specific regional setting without offering user choice or documenting why that locale is required.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.