T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/playwright-simple.js:11- Finding
Unrestricted URL Navigation Enables Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
Security audit
102 Playwright Scraper Skill
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed web-scraping skill, but its stealth mode weakens browser safety controls and gives broad network and file-write authority without enough guardrails.
Install only if you are comfortable running a browser scraper against sites you are authorized to access. Prefer running it in a disposable, low-privilege environment with restricted network access, avoid authenticated or sensitive pages unless necessary, and choose safe output locations for screenshots or HTML captures.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/playwright-stealth.js:43- Finding
Stealth Browser Disables Chromium Sandbox and Site Isolation
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/playwright-stealth.js:25- Finding
Unrestricted Output Paths Permit Arbitrary File Overwrite
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:87- Finding
Documentation Installs and Executes an Unpinned External Skill
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (36)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description emphasizes anti-bot protection and successful use on complex protected sites. However, the supplied code is a basic Playwright script: it launches Chromium, visits a URL, waits, reads visible text and metadata, and optionally takes a screenshot. There are no signs of anti-bot handling such as stealth plugins, proxy rotation, custom fingerprinting, CAPTCHA handling, header/user-agent spoofing, session management, or retry logic. In fact, the inline comment says it is intended for 'general dynamic websites, no anti-scraping protection' (無反爬保護). That makes the primary capability materially different from the description. The screenshot feature is a minor supporting detail, not the main mismatch.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **Cloudflare Protected** | High | **Playwright Stealth** ⭐ | `scripts/playwright-stealth.js` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **Cloudflare Protected** | High | **Playwright Stealth** ⭐ | `scripts/playwright-stealth.js` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **Cloudflare Protected** | High | **Playwright Stealth** ⭐ | `scripts/playwright-stealth.js` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **Cloudflare Protected** | High | **Playwright Stealth** ⭐ | `scripts/playwright-stealth.js` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **Cloudflare Protected** | High | **Playwright Stealth** ⭐ | `scripts/playwright-stealth.js` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **Cloudflare Protected** | High | **Playwright Stealth** ⭐ | `scripts/playwright-stealth.js` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **Cloudflare Protected** | High | **Playwright Stealth** ⭐ | `scripts/playwright-stealth.js` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **Cloudflare Protected** | High | **Playwright Stealth** ⭐ | `scripts/playwright-stealth.js` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **Cloudflare Protected** | High | **Playwright Stealth** ⭐ | `scripts/playwright-stealth.js` |
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh echo "" # 清理 rm -f /tmp/test-*.json screenshot-*.png echo "✅ 所有測試通過！"
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 86% confidence
- Finding
The README instructs users to run
npx playwright install chromiumwithout pinning a specific Playwright version, which can cause retrieval of whatever package/version is current in the environment or registry at execution time. This weakens supply-chain reproducibility and increases exposure to compromised, typosquatted, or unexpectedly changed upstream packages.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README explicitly recommends stealth mode and lists anti-bot evasion techniques such as hiding
navigator.webdriver, spoofing user agents, and simulating human behavior, but gives no warning about authorization, terms-of-service, or legal/compliance boundaries. In context, this materially increases misuse risk because the skill is specifically positioned to bypass detection on protected sites rather than merely automate benign browsing.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The README promotes screenshot and full HTML saving but provides no warning that these outputs can capture credentials, session tokens, personal data, or other sensitive page content. In a scraping skill, stored artifacts may persist on disk, be shared, or be ingested by downstream tooling, expanding the blast radius of accidental data exposure.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 86% confidence
- Finding
The reinstall instructions again tell users to invoke
npx playwright install chromiumwithout ensuring the CLI comes from a pinned local dependency. Repeated unpinned execution paths increase supply-chain risk and make builds non-reproducible, especially in automated or fresh environments.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The README explicitly promotes stealth scraping, bypassing anti-bot protections, screenshot capture, and HTML saving, but provides no warning about authorization, privacy, sensitive-data handling, or legal constraints. In a scraping skill, this omission increases the chance of misuse against protected sites and unsafe collection or storage of personal or confidential content.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill documents use of environment variables and executable scripts but declares no explicit tool scope or permissions boundary. In a skill ecosystem, missing scope metadata can cause the agent or operator to grant broader execution capability than intended, reducing transparency and increasing the chance of unsafe invocation.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 88% confidence
- Finding
Using
npx playwrightwithout pinning a version makes installation non-reproducible and exposes users to supply-chain risk if a newer or compromised package version is resolved. Because this command pulls and executes code at install time, an attacker controlling the dependency path could achieve arbitrary code execution in the user's environment.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill advertises screenshot and HTML saving for scraped pages without warning about local data capture, sensitive content retention, or where files are written. In scraping contexts, saved artifacts may contain credentials, personal data, session information, or proprietary page content, creating privacy and data-handling risks for operators.
- Content