Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Playwright Test Generator
v1.0.1AI-driven Playwright test code generator for QA engineers. Generates Page Object Models, standard test scripts, and data-driven tests from natural language d...
⭐ 0· 18·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md and description claim an instruction-only skill with no required binaries or env vars, but the package contains substantial code (Python and Node modules), package.json/package-lock.json, and Python modules that call Playwright (which requires installing browsers). The skill will legitimately need Playwright, Node/Python runtimes, and browser binaries to implement URL analysis, but those requirements are not declared in the registry metadata (no required binaries, no install spec). This mismatch is incoherent and means installing/running the skill may trigger additional dependency installs or fail unexpectedly.
Instruction Scope
The SKILL.md and code instruct the agent to analyze arbitrary URLs/HTML and run a headless Playwright browser to extract DOM and generate code. That is within the stated purpose, but it grants the skill network access to any URL the user provides (including internal/intranet hosts) and will execute headless browser sessions. There are no instructions that read unrelated local files or request unrelated credentials, but the network/browser capability is powerful and should be used with caution.
Install Mechanism
Registry metadata lists no install spec, yet the bundle includes package.json, package-lock.json, and Python modules that depend on 'playwright' (and node deps like cheerio, ejs). Because there is no declared install step, it's unclear how dependencies (npm packages and Playwright browser binaries) will be installed. Playwright commonly downloads large browser binaries at install/run time; the absence of an explicit install mechanism or provenance for these packages is a risk and a coherence problem.
Credentials
The skill does not request environment variables or credentials in the registry metadata, and its code does not appear to require secrets to perform page analysis or code generation. This is proportionate to the stated functionality. Note: generated login tests will require credentials to be useful, but the skill sensibly documents that login tests need manual credential handling rather than requesting secrets itself.
Persistence & Privilege
The skill is not set to always:true and does not request elevated/always-on privileges. It writes generated test files to output directories (expected behavior) and does not appear to modify other skills or system-wide configuration. Autonomous invocation is enabled by default but not combined with other red flags here.
What to consider before installing
This package actually contains runnable code (Python + Node) and depends on Playwright and other npm packages, but the registry entry claims no install steps or required binaries — that mismatch is the main red flag. Before installing or running: 1) Confirm where the package will be installed from (origin/provenance) and prefer a trusted source (GitHub release, npm registry). 2) Expect that installing or first run may download Playwright browser binaries (large downloads) — do this in a controlled environment. 3) Run the tool in an isolated/sandboxed environment if you will analyze untrusted or internal URLs (the skill will open headless browsers and access arbitrary network hosts). 4) Verify package.json/package-lock integrity (checksums, repo) and inspect src/index.js / generator code for any hidden network calls or unexpected external endpoints before granting network access. 5) If you only need narrow functionality (e.g., NL→test generation without live URL analysis), prefer invoking the parts that don't launch browsers or require Playwright to avoid extra risk. If you want, provide how you plan to install/run this skill (local CI, developer machine, or hosted agent) and I can give more specific hardening steps.Like a lobster shell, security has layers — review code before you run it.
automationvk970q32nwjac4pmcrz8w292j5n84b1dkgeneratorvk97a84dcnvj76e0y8nv81d67cs84anbqlatestvk97a84dcnvj76e0y8nv81d67cs84anbqplaywrightvk97a84dcnvj76e0y8nv81d67cs84anbqqavk97a84dcnvj76e0y8nv81d67cs84anbqtest-automationvk97a84dcnvj76e0y8nv81d67cs84anbqtestingvk970q32nwjac4pmcrz8w292j5n84b1dk
License
MIT-0
Free to use, modify, and redistribute. No attribution required.