Pascal Playwright Mcp

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:02 PM UTC
• Version: 1.0.0

Overview

This is a coherent browser automation skill, but it needs review because it repeatedly runs unpinned npm packages and gives broad browser-control workflows without strong safety warnings.

Review before installing. Prefer a pinned, reviewed `@playwright/mcp` and `playwright` version, avoid running global npm installs with elevated privileges, restrict allowed hosts, avoid `--ignore-https-errors` except in controlled testing, and treat screenshots, traces, videos, page snapshots, and extracted text as potentially sensitive.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned npm packages are installed and executed without integrity verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:4, SKILL.md:14-21, and SKILL.md:24-32
Vulnerability Type: Supply-chain exposure through unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

SKILL.md:4:

yaml

metadata: {"openclaw":{"emoji":"🎭","os":["linux","darwin","win32"],"requires":{"bins":["playwright-mcp","npx"]},"install":[{"id":"npm-playwright-mcp","kind":"npm","package":"@playwright/mcp","bins":["playwright-mcp"],"label":"Install Playwright MCP"}]}}

SKILL.md:14-21:

bash

npm install -g @playwright/mcp
# Or
npx @playwright/mcp

bash

npx playwright install chromium

SKILL.md:24-32:

bash

# Start MCP Server (STDIO mode)
npx @playwright/mcp

bash

# Headless mode
npx @playwright/mcp --headless

# Specific browser
npx @playwright/mcp --browser firefox

Technical Analysis

The documented installation and execution commands do not pin @playwright/mcp or playwright to exact, previously reviewed versions. The metadata also identifies @playwright/mcp without a version constraint. No lockfile or integrity hash is included in the project.

Consequently, package resolution depends on mutable npm registry state at the time a user follows the instructions. In particular, npx may download and execute a package that is not already installed locally. Package installation can also run lifecycle scripts unless separately disabled. A compromised package release, dependency, publisher account, or registry response could therefore introduce code that was not present during this audit.

The issue is supply-chain exposure rather than evidence that the currently published Playwright package is malicious.

Attack Path

1. An attacker compromises the publisher account, package release process, transitive dependency, or relevant registry delivery path.
2. The attacker publishes or serves a malicious version under a pa ...[truncated 1159 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every executable package to an exact reviewed version, for example:

   bash

   npm install -g @playwright/mcp@<reviewed-exact-version>
   npx --yes @playwright/mcp@<reviewed-exact-version>
   npx --yes playwright@<reviewed-exact-version> install chromium
   

2. Add the exact version to the skill installation metadata rather than relying on the registry's current default release.

3. Prefer a project-local installation governed by a committed lockfile containing npm integrity hashes. Use deterministic installation commands such as npm ci.

4. Verify package publisher identity, release provenance, signatures or attestations, and integrity before updating the pinned version.

5. Review transitive dependency changes before accepting upgrades. Use automated dependency and vulnerability scanning as an additional control.

6. Disable lifecycle scripts during installation where operationally practical, then explicitly permit only reviewed setup steps:

   bash

   npm ci --ignore-scripts
   

7. Avoid running global npm installation commands with administrator or root privileges. Execute the MCP server under a dedicated, least-privileged account or sandbox with restricted filesystem and network access.

8. Replace repeated registry-resolving npx commands with execution of the verified, locally installed binary.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill invokes shell-capable installation and execution commands (npm install, npx) but does not declare an explicit tool scope such as permissions or allowed-tools. In an agent setting, this can cause the runtime to grant broader-than-necessary execution capability, increasing the chance of unintended command execution or unsafe use of the host environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill description advertises browser automation capabilities but does not clearly warn that actions may submit forms, click controls, or otherwise trigger real effects on external websites. In agent-driven use, this omission can lead users to invoke the skill without understanding that it may perform state-changing actions such as purchases, submissions, or account changes.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

Using npx @playwright/mcp without pinning a version allows whatever package version is current at execution time to be fetched and run. This creates a supply-chain risk: a compromised upstream release or unexpected breaking update could execute attacker-controlled code on the host.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

Running npx playwright install chromium without pinning the Playwright package version introduces non-deterministic dependency resolution. A malicious or compromised package version could be pulled at runtime, leading to arbitrary code execution during install or browser setup.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The quick-start command launches the MCP server via unpinned npx, which fetches and executes code at runtime. In a skill intended for automation, this is especially dangerous because the server may then receive browser-control instructions with access to external sites and potentially sensitive session data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The headless-mode example uses an unpinned runtime package invocation, exposing users to the same supply-chain and arbitrary code execution risk as other npx examples. Repetition throughout the skill increases the chance that users copy unsafe commands directly.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The Firefox example runs the MCP server from an unpinned package reference, which can resolve to an unexpected or compromised release. Because this skill enables browser automation, a malicious server build could exfiltrate data, intercept credentials, or run arbitrary host-side actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The viewport-size example still relies on unpinned npx execution, preserving a time-of-use package substitution risk. Since the command is likely to be copied verbatim, documentation here directly propagates unsafe operational practice.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This example combines unpinned package execution with --ignore-https-errors, which weakens transport security while running remotely fetched code. The combination heightens risk because users may both execute an untrusted package version and automate browsing against sites without proper TLS validation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The examples and options describe data extraction, screenshots, traces, videos, and page evaluation without a clear warning that these artifacts can capture credentials, personal data, session tokens, or other sensitive information. In this skill context, automated browsing frequently touches authenticated pages, making inadvertent collection or retention of sensitive material more likely.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The troubleshooting command npx playwright install chromium is also unpinned, extending the supply-chain risk into maintenance and recovery workflows. Users often trust troubleshooting sections and may run these commands with elevated privileges or on production hosts.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The debug-mode example launches an unpinned package version, which is risky because debug sessions may expose additional output, traces, or diagnostics if a malicious package is executed. This expands both code-execution risk and potential information disclosure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.