Playwright Browser Automation

• Analyzed: May 12, 2026, 3:38 AM
• Findings: 1
• Version: 2.0.0
• Hash: cb878e44a97dc712c401b1bec4f54606bb1845fd423f9324a793e04b63ffb8e0
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious primarily due to the 'Sudoers Setup' instructions in `SKILL.md`. These instructions advise configuring `sudoers` to allow passwordless execution of `npx playwright install-deps *` and `npx playwright install *`. While presented as a setup step for Playwright, granting NOPASSWD for commands that download and install software is a significant privilege escalation risk, increasing the attack surface if the agent or system is compromised. Other capabilities like network access, file operations (screenshots, downloads, uploads), and arbitrary JavaScript execution via `page.evaluate()` are inherent to browser automation and align with the stated purpose, without explicit malicious intent in the provided examples.