Flexible Web Tester

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:32 AM UTC
• Version: 1.0.2

Overview

The skill is a coherent web testing tool, but it asks for browser, terminal, filesystem, and credential handling in ways that are under-scoped and could expose sensitive data.

Install only if you are comfortable granting this skill filesystem, terminal, and browser-control access. Use disposable test accounts, avoid real passwords, avoid production sites unless isolated, pin the Playwright MCP dependency to a reviewed version, and keep generated scripts/reports out of source control until secrets and screenshots are reviewed or removed.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T08 · Insecure Dependencies

Error

• Location: README.md:39
• Finding: Unpinned Runtime Dependency Allows Unreviewed Code Execution## Vulnerability Details **File Location**: `README.md`, lines 39-47 **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: High **Vulnerable Configuration**: ```json { "mcpServers": { "playwright": { "command": "npx", "args": ["@playwright/mcp@latest"] } } } ``` ### Technical Analysis The documented MCP configuration launches `@playwright/mcp@latest` through `npx`. The `latest` distribution tag is mutable and does not identify an immutable, previously reviewed package version. Depending on the local npm cache and `npx` behavior, starting the MCP service may download and execute package code that was not present during this audit. The effective executable can consequently change without any modification to this project. The configuration also provides no lockfile, integrity hash, package provenance verification, or installation review step. This creates a supply-chain trust boundary in which control of the upstream package, its publishing credentials, the npm account, or the mutable distribution tag can determine which code runs locally. ### Attack Path 1. An attacker compromises the upstream package, maintainer account, publishing token, or package distribution process. 2. The attacker publishes a malicious package version and assigns it to the `latest` tag. 3. A user follows the documented configuration and starts the Playwright MCP service. 4. `npx` resolves `@playwright/mcp@latest` to the attacker-controlled release. 5. The downloaded package executes with the privileges and environment of the MCP process. 6. The malicious package can access resources available to that process, potentially including environment variables, browser sessions, accessible local files, and network connectivity. ### Impact Assessment Successful exploitation permits arbitrary code execution under the operating-system account that launches the MCP service. The precise scop ...[truncated 432 chars]
• Remediation: ## Remediation Suggestions - Replace `@playwright/mcp@latest` with an exact, reviewed version. - Install dependencies in a controlled setup phase rather than downloading them implicitly when the MCP server starts. - Commit and enforce a package lockfile where applicable. - Verify package integrity and provenance before installation. - Use an internal registry or approved dependency mirror for production deployments. - Run the MCP process in a restricted environment with minimal filesystem access, limited environment variables, and constrained network access. - Establish a deliberate dependency-update process that reviews release changes before changing the pinned version.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:53
• Finding: Plaintext Credentials May Be Persisted in Generated Test Scripts## Vulnerability Details **File Location**: `SKILL.md`, lines 53-98 **Vulnerability Type**: Unsafe handling and persistence of authentication credentials **Risk Level**: High **Relevant Instructions — English Translation**: ```text [L2] Automatic filling: provide a username and password, and I will automatically complete the login process. Engine B (Python script driven): - Generate thoroughly commented Python and Playwright code. - The code must include browser startup configuration, explicit waits, retries, assertions, exception handling, screenshots, and a main entry point. Mandatory file persistence: Call the File System MCP and save the plan locally. Engine B filename: {YYYYMMDD}_test_script.py Engine B file content: Complete runnable Python code. ``` ### Technical Analysis The workflow explicitly collects a username and password and, for Engine B, requires the Agent to generate complete runnable Python code and persist that code to a local file. It does not instruct the Agent to keep credentials out of the generated source, retrieve them from a protected secret provider, redact them from output, or remove them after execution. A straightforward generated Playwright script may therefore interpolate supplied credentials directly into string literals. Such credentials can then remain in the generated script after the test finishes. The same sensitive values may also be exposed through exception messages, terminal output, screenshots, reports, source-control commits, filesystem backups, or subsequent Agent context. ### Attack Path 1. A user selects automatic login and provides a username and password. 2. The user selects the Python script execution engine. 3. The Agent generates complete runnable Playwright source code. 4. In the absence of secret-handling requirements, the Agent embeds the supplied values directly in the generated script. 5. The mandatory file-write step persists the script in ...[truncated 767 chars]
• Remediation: ## Remediation Suggestions - Prohibit embedding usernames, passwords, tokens, session cookies, and other secrets in generated source files. - Retrieve credentials at runtime from protected environment variables, an operating-system credential store, or an approved secret manager. - Prefer an interactive secret prompt that does not echo or persist the entered value. - Generate scripts that reference variable names such as `TEST_USERNAME` and `TEST_PASSWORD`, never literal values. - Redact secrets from terminal output, exception messages, reports, screenshots, DOM captures, and Agent responses. - Add generated scripts and evidence directories to appropriate source-control ignore rules. - Apply restrictive filesystem permissions to generated artifacts. - Define a retention policy and securely remove sensitive temporary artifacts after execution. - Warn users not to provide production credentials and recommend restricted, disposable test accounts.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:134
• Finding: Unquoted Working Directory Interpolation Enables Shell Command Injection## Vulnerability Details **File Location**: `SKILL.md`, lines 134-138 **Vulnerability Type**: Shell command injection **Risk Level**: High **Vulnerable Command — English Translation**: ```sh cd {working_directory} && python3 {YYYYMMDD}_test_script.py ``` ### Technical Analysis The skill instructs the Agent to construct a shell command by directly interpolating the working-directory value. The placeholder is neither quoted nor constrained to a validated path. If an attacker can influence that value, shell metacharacters such as semicolons, command substitutions, redirections, or logical operators can change the intended command structure. Paths containing ordinary spaces may also break execution, even when they are not malicious. User confirmation before execution reduces accidental activation but does not eliminate the vulnerability: a user may approve a generated testing plan without recognizing a malicious directory value or the command may not be displayed in its final expanded form. ### Attack Path 1. An attacker influences the selected working directory through user input, a crafted workspace name, imported configuration, or an untrusted project path. 2. The value contains shell syntax that terminates or extends the intended `cd` command. 3. The Agent substitutes the value into the documented command template. 4. After the required confirmation, the CLI MCP passes the resulting string to a command shell. 5. The shell interprets the injected metacharacters rather than treating the entire value as a directory path. 6. The injected command executes with the privileges granted to the CLI MCP process. ### Impact Assessment Successful exploitation can provide arbitrary command execution as the user or service account running the CLI MCP. Depending on that account's permissions, an attacker could read or modify accessible files, steal credentials and environment variables, install additional software, alter ge ...[truncated 269 chars]
• Remediation: ## Remediation Suggestions - Do not construct a shell command by concatenating or interpolating path values. - Use a process-execution API that accepts an argument array and a separate `cwd` parameter. - Resolve and canonicalize the working directory before execution. - Require the resolved path to remain inside an explicitly approved workspace root. - Reject unexpected control characters, shell metacharacters, and invalid path forms. - If shell invocation is unavoidable, apply platform-appropriate robust quoting to every dynamic value; validation and workspace confinement must still be enforced. - Execute the generated script by an absolute, validated path. - Display the exact executable, arguments, and working directory to the user before confirmation. - Restrict CLI MCP privileges and run generated scripts in a sandbox with limited filesystem and network access.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:10
• Finding: Preflight Check Permits Unnecessary Access to Arbitrary Local Files## Vulnerability Details **File Location**: `SKILL.md`, lines 10-13 **Vulnerability Type**: Overbroad local filesystem access during environment validation **Risk Level**: Medium **Relevant Instruction — English Translation**: ```text When the user starts this skill, immediately perform the following implicit environment checks: 1. Check file read/write capability: try to list or read a known existing local file to verify that the File System MCP is available. 2. Check terminal execution capability. 3. Check browser-control capability. ``` ### Technical Analysis The mandatory preflight procedure allows the Agent to list or read a “known existing local file” without restricting the operation to a dedicated test fixture or approved workspace. Reading an arbitrary pre-existing file is not necessary to establish whether the filesystem tool is available. Because the check is described as immediate and implicit, it may occur before the user supplies a target or expressly approves access to a particular local path. If the Agent selects a sensitive file, its contents can enter the Agent context and may subsequently appear in logs, traces, or generated output. The instruction does not explicitly direct the Agent to read a sensitive file, and no exfiltration destination is specified. The risk arises from the absence of path confinement and least-privilege requirements. ### Attack Path 1. The user activates the skill. 2. The mandatory implicit preflight check begins immediately. 3. The Agent chooses a known local file outside the project workspace to verify read access. 4. The File System MCP returns the file contents or directory listing. 5. Sensitive names or content enter the Agent's processing context. 6. The information may be retained in tool traces, operational logs, generated artifacts, or later responses accessible to other authorized users or systems. ### Impact Assessment The possible exposure is li ...[truncated 467 chars]
• Remediation: ## Remediation Suggestions - Replace the arbitrary-file read with a dedicated, non-sensitive fixture located inside the approved skill workspace. - Test write access by creating a uniquely named temporary file containing non-sensitive data, reading it back, and deleting it. - Enforce filesystem allowlists that confine the MCP to the project and designated artifact directories. - Do not inspect home-directory files, credential stores, browser profiles, SSH directories, or unrelated repositories. - Tell the user which directory will be accessed before running the preflight check. - Return only a capability result; do not include fixture contents in the conversational context. - Ensure temporary probe files are created with restrictive permissions and reliably removed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The skill promises a confirmation gate before browser or terminal actions, yet its startup logic explicitly requires terminal and browser MCP invocations during pre-flight. This breaks the stated safety boundary and can trigger side effects before the user has consented to any execution, undermining trust and enabling unintended command or browser activity.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill explicitly solicits usernames and passwords and plans to use them for automated login, but it provides no warning about sensitive data handling, storage, redaction, retention, or safer alternatives. In this skill's context, that is especially dangerous because credentials may be echoed into generated scripts, saved to disk, included in reports, or exposed through logs and terminal history.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README advertises automatic saving of test plans and reports to local disk, but it does not warn users that potentially sensitive data such as URLs, page contents, screenshots, cookies, or test artifacts may be persisted. In a web-testing skill, silent persistence increases the risk of unintended retention of confidential application data on the operator’s machine.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The example shows automatic form filling with a username and password, but the documentation lacks any warning about handling credentials, secret exposure in logs/files, or use against production systems. Given this skill also supports script generation and automatic report saving, supplied credentials could be captured in generated scripts, terminal history, or saved reports.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The description states the skill is a Chinese-language web UI testing workbench, and the rest of the file presents all required prompts and confirmations in Chinese only. There is no indication that the user may choose another language, so the skill appears to enforce a locale without opt-in.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger conditions are broad enough to activate on common references to testing, websites, Playwright, or OpenClaw, which increases the chance the skill runs in contexts where the user did not intend full web automation behavior. Over-broad auto-triggering is risky here because the skill can lead to file writes, credential collection, and later browser or CLI actions.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: The user-facing instructions and examples are entirely in Chinese, which can amount to forcing a specific language without explicit user opt-in. The README does not state that the skill is region-specific or offer an alternative language option.

Static analysis

No suspicious patterns detected.