T08 · Insecure Dependencies
Warning
- Location
SKILL.md:15- Finding
Unpinned mutable dependencies allow supply-chain code execution
- Content
View full analysis
- Remediation
View remediation
Security audit
Playwright Cli
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent Playwright browser automation guide, but it grants broad npm/browser powers that can expose logged-in sessions or run mutable packages without enough safeguards.
Install only if you need advanced Playwright automation. Use isolated test accounts and browser profiles, pin npm package versions, avoid attaching to your personal logged-in browser, do not run untrusted run-code scripts, and never save or print cookies, tokens, or auth state unless you can protect and delete them.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
references/examples.md:407- Finding
Browser authentication state is stored and exposed without secret-handling safeguards
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (26)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
run-codeenables execution of custom code in the browser context andkill-allcan forcibly terminate processes, but the reference gives no warning about code trust, irreversible side effects, or operational disruption. In an agent skill, undocumented access to these powerful actions materially raises the risk of harmful automation, session abuse, or destruction of active work.- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The state persistence examples show saving authentication state, listing cookies, retrieving a session cookie, and piping tokens to shell variables without any credential-handling warning. These examples normalize extraction and storage of reusable auth material, which could enable session hijacking or accidental leakage through files, logs, terminals, or downstream tools.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill description and trigger conditions are broad enough that the skill may activate for loosely related mentions of browsers, testing, or automation. In an agent environment with Bash execution privileges, unintended activation can expand the chance of risky command execution on the wrong task.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The keyword-based activation guidance instructs the framework to load the skill on simple term matches like 'test' or 'playwright' without contextual boundaries. This can cause accidental invocation for unrelated tasks and expose powerful Bash/browser capabilities where they were not needed.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 81% confidence
- Finding
The skill recommends invoking Playwright via npx without a pinned version, which can cause execution of whatever version is resolved at runtime. In an agent skill context, this weakens supply-chain control and can lead to unexpected behavior or execution of a compromised or incompatible package.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The storage section includes listing, reading, setting, deleting, and clearing cookies, localStorage, and sessionStorage. While some state handling can support testing, the breadth of direct storage manipulation and inspection is more akin to browser data administration and credential/session handling than the manifest's stated browser automation trigger description.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document describes session-state mutation and destructive commands such as cookie deletion and storage clearing without warning users that they can destroy login state, invalidate sessions, or overwrite browser data. In a reusable automation skill, lack of such warnings increases the chance of accidental data loss or misuse against real-user profiles.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The request inspection, tracing, console capture, and video recording features can collect sensitive URLs, headers, form contents, tokens, and visual data, yet the reference provides no privacy or data-handling warning. Users may unknowingly capture secrets or personal data during browser sessions and store them in logs or artifacts.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest describes a Playwright-based browser automation skill for web testing, page interaction, and automation workflows. The
run-codecommand explicitly advertises running custom code, which is materially broader than ordinary scripted interactions and exposes a general execution capability not conveyed by the manifest description.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md playwright-cli route "**/*.png" --status=404 # 模拟 API 响应 playwright-cli route "https://api.example.com/users" --body='{"users": [{"id": 1, "name": "Test User"}]}' # 查看已设置的路由 playwright-cli route-list
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md playwright-cli route "**/*.png" --status=404 # 模拟 API 响应 playwright-cli route "https://api.example.com/users" --body='{"users": [{"id": 1, "name": "Test User"}]}' # 查看已设置的路由 playwright-cli route-list
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md playwright-cli route "**/*.png" --status=404 # 模拟 API 响应 playwright-cli route "https://api.example.com/users" --body='{"users": [{"id": 1, "name": "Test User"}]}' # 查看已设置的路由 playwright-cli route-list
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md playwright-cli route "**/*.png" --status=404 # 模拟 API 响应 playwright-cli route "https://api.example.com/users" --body='{"users": [{"id": 1, "name": "Test User"}]}' # 查看已设置的路由 playwright-cli route-list
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The video recording and tracing examples encourage capture of browser interactions without warning that recordings and traces can contain passwords, tokens, personal data, page contents, and authenticated workflows. In a browser automation skill, these artifacts are easy to retain, share, or mishandle, creating privacy and credential exposure risk.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 83% confidence
- Finding
The example instructs users to run
npx playwright show-trace trace.zip, which pulls and executes an unpinned package version at runtime. That creates a supply-chain and reproducibility risk because a future compromised or incompatible release could be fetched implicitly when viewing trace artifacts.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The '自定义代码执行' section explicitly documents
run-codefor arbitrary Playwright/JavaScript execution, including loading code from a file. In an agent skill, this materially expands capability from constrained browser automation into general script execution against live browser contexts, enabling credential extraction, silent data collection, or unsafe side effects on behalf of the user.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The custom code execution section permits arbitrary browser-context scripting without any warning about abuse potential. Because such code can inspect page content, cookies via browser APIs/context, DOM state, and perform arbitrary actions, presenting it as a routine example materially increases the chance of unsafe or unauthorized use.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The examples show attaching to an already running browser via CDP, including arbitrary endpoints. This can grant the skill access to pre-authenticated sessions, cookies, open tabs, and sensitive data outside the intended isolated automation session, significantly broadening the trust boundary.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This markdown file presents all operational instructions in a single language and does not indicate that the user can opt into another language or that the skill is intentionally region-specific. That can violate language/locale policy when users are not given a choice.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
Natural-language policy violations include forcing a specific language without user opt-in. This reference file presents all instructional content in Chinese and does not indicate that the skill is region-specific or that alternative language support is available.
- Content
Static analysis
No suspicious patterns detected.