Playwright Browser Automation

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:20 PM UTC
• Version: 2.0.0

Overview

The skill is for Playwright browser automation, but it includes under-scoped privileged setup guidance that could grant persistent passwordless root access.

Review before installing. Do not apply the sudoers instructions, avoid sudo npx, pin Playwright through a project lockfile, and run browser automation in an isolated unprivileged environment. Treat auth.json, recordings, traces, screenshots, downloads, and uploaded local files as sensitive data.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:291

Finding

Persistent Passwordless Root Authorization with Wildcard Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 291-297
Vulnerability Type: Passwordless privilege escalation through an overly broad sudoers policy
Risk Level: High

Vulnerable Code

bash

## Sudoers Setup

For Playwright browser installation:

# /etc/sudoers.d/playwright
username ALL=(root) NOPASSWD: /usr/bin/npx playwright install-deps *
username ALL=(root) NOPASSWD: /usr/bin/npx playwright install *

Technical Analysis

The documented sudoers configuration permanently authorizes the specified account to execute matching npx playwright installation commands as root without authentication. The trailing wildcard permits variable arguments instead of restricting execution to one fixed, reviewed command.

This violates least-privilege principles because ordinary browser automation does not require persistent passwordless root authorization. It also places a package-management execution path behind a broadly delegated root permission. The authorization remains active across sessions until the sudoers file is removed.

Attack Path

1. An administrator follows the documented setup and creates /etc/sudoers.d/playwright.
2. The designated account receives passwordless authorization for the listed root commands.
3. An attacker compromises that account or gains the ability to invoke commands as that user.
4. The attacker supplies arguments accepted by the broad sudoers rule or abuses package-provided installation behavior.
5. The authorized command executes with root privileges without requiring the administrator's password.
6. Successful abuse can lead to root-level modification of files, dependencies, or system configuration.

Impact Assessment

Successful exploitation can cross the boundary from an ordinary user account to root. Root access would permit system-wide file modification, software installation, credential access, security-control modification, and compromise of a ...[truncated 129 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the proposed passwordless sudoers configuration.
• Install required operating-system dependencies once through an administrator-controlled provisioning process.
• Do not execute package-manager or npx commands directly through unrestricted sudo.
• Pin and review the exact Playwright version before privileged installation.
• If delegation is operationally unavoidable, create an immutable, root-owned wrapper script that accepts no user-controlled arguments.
• Restrict sudoers authorization to that wrapper's absolute path and fixed behavior.
• Validate sudoers changes with visudo and periodically review delegated privileges.
• Prefer running Playwright in a dedicated, unprivileged container or service account.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:5

Finding

Unpinned Third-Party Package Installation and Privileged Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5 and 14-23
Vulnerability Type: Mutable dependency resolution and unsafe privileged package execution
Risk Level: High

Vulnerable Code

yaml

metadata: {"openclaw":{"emoji":"🎭","os":["linux","darwin","win32"],"requires":{"bins":["node","npx"]},"install":[{"id":"npm-playwright","kind":"npm","package":"playwright","bins":["playwright"],"label":"Install Playwright"}]}}

bash

# Install Playwright
npm install -g playwright

# Install browsers (one-time, ~100MB each)
npx playwright install chromium
# Optional:
npx playwright install firefox
npx playwright install webkit

# For system dependencies on Ubuntu/Debian:
sudo npx playwright install-deps chromium

Technical Analysis

The installation metadata and commands identify playwright only by package name, without an exact version or integrity value. Consequently, installation can resolve to package content that differs from the version originally reviewed.

The use of npm install -g creates a system-wide installation. More critically, sudo npx playwright install-deps chromium executes package-provided CLI behavior with root privileges. If the resolved package, its dependency chain, the registry account, or the delivery channel is compromised, attacker-controlled code could execute during installation with elevated privileges.

The package name corresponds to the legitimate Playwright project; no typosquatted dependency was identified. The vulnerability is the mutable, unverified, and potentially privileged dependency execution process.

Attack Path

1. A user follows the installation instructions.
2. npm or npx resolves the current package and dependency versions from the configured registry.
3. A compromised package release, dependency, registry account, or delivery path supplies malicious content.
4. Package lifecycle logic or CLI code executes during installa ...[truncated 729 chars]

Remediation

View remediation

Remediation Suggestions

• Pin Playwright to an exact reviewed version rather than using an unversioned package name.
• Use a project-local dependency instead of npm install -g.
• Commit and enforce a lockfile containing integrity metadata.
• Use deterministic installation commands such as npm ci.
• Verify package provenance and integrity through an approved registry or internal package mirror.
• Disable or tightly control dependency lifecycle scripts where operationally feasible.
• Do not run npx or package-manager-resolved code directly with sudo.
• Provision operating-system dependencies separately through a trusted, administrator-controlled package-management process.
• Perform dependency scanning and review version updates before deployment.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:253

Finding

Browser Sandbox and Content Security Policy Protections Disabled

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 253-266
Vulnerability Type: Unsafe browser security configuration
Risk Level: High

Vulnerable Code

javascript

const browser = await chromium.launch({
  headless: true,        // Run without UI
  slowMo: 50,           // Slow down by 50ms (for debugging)
  devtools: false,      // Open DevTools
  args: ['--no-sandbox', '--disable-setuid-sandbox'] // Docker/Ubuntu
});

const context = await browser.newContext({
  viewport: { width: 1920, height: 1080 },
  locale: 'ru-RU',
  timezoneId: 'Europe/Moscow',
  geolocation: { latitude: 55.7558, longitude: 37.6173 },
  permissions: ['geolocation'],
  userAgent: 'Custom Agent',
  bypassCSP: true,      // Bypass Content Security Policy
});

Technical Analysis

The Chromium flags --no-sandbox and --disable-setuid-sandbox disable important process-isolation controls. The browser sandbox is intended to limit the host-level consequences of a renderer or browser vulnerability when processing untrusted web content.

The bypassCSP: true option also disables enforcement of the page's Content Security Policy for the automation context. This changes the target site's security model and can permit script or resource behavior that the site intended to block.

Granting geolocation permission without restricting the example to a trusted origin unnecessarily expands browser capabilities. Although these options may occasionally be needed in a tightly isolated test environment, presenting them as general configuration encourages unsafe deployment.

Attack Path

1. A developer adopts the example configuration in an automation workflow.
2. The automated browser visits an attacker-controlled or compromised website.
3. The page delivers malicious content or attempts to exploit a browser vulnerability.
4. CSP bypass allows behavior that the page's policy would otherwise restrict.
5. If a b ...[truncated 863 chars]

Remediation

View remediation

Remediation Suggestions

• Remove --no-sandbox and --disable-setuid-sandbox from general-purpose examples.
• Run Chromium as a dedicated, unprivileged user with its sandbox enabled.
• Remove bypassCSP: true unless a specific, documented test requires it.
• Create a separate hardened configuration for exceptional CSP-bypass testing.
• Run unavoidable no-sandbox testing inside a strongly isolated, disposable container or virtual machine.
• Restrict network access and mounted files available to browser workers.
• Grant browser permissions only when needed and, where supported, scope them to explicitly trusted origins.
• Keep Playwright and browser binaries updated to reviewed security-patched versions.
• Avoid storing reusable credentials or sensitive authentication state in an inadequately isolated browser context.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description says the skill provides direct Playwright API browser automation and is more reliable than an MCP approach. The supplied code instead demonstrates conceptual interaction with a Playwright MCP server by constructing JSON-RPC tool-call payloads and printing them. No actual browser session is launched, no Playwright API is imported or invoked, and several declared capabilities (screenshots, PDFs, videos) are absent. The primary purpose is therefore materially different from the declared description.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill documents shell-based installation and system configuration steps but does not declare any explicit tool scope or permissions. In an agent ecosystem, this can cause reviewers or runtime policy to underestimate the skill's ability to invoke shell commands, increasing the chance of unintended command execution or unsafe deployment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

Using npx playwright without pinning a specific package version makes installation and execution depend on whatever version is current at runtime. That creates a supply-chain and reproducibility risk: a compromised or breaking upstream release could be pulled automatically into environments using this skill.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The unpinned npx playwright install chromium command retrieves whatever Playwright version is resolved at execution time. This weakens supply-chain control and can introduce unreviewed code or inconsistent browser artifacts into automated environments.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The example npx playwright install firefox is unpinned and therefore subject to version drift and upstream package compromise. In a skill intended for automation, that can silently alter runtime behavior or pull malicious dependencies if the package supply chain is affected.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

The use of sudo to install browser dependencies introduces privileged execution into a skill that otherwise performs browser automation. Even if legitimate for setup, normalizing root-level commands in skill documentation increases the chance of unsafe execution, especially when combined with unpinned package resolution.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

npx playwright install webkit

For system dependencies on Ubuntu/Debian:

sudo npx playwright install-deps chromium

text

## Quick Start

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The root-level command sudo npx playwright install-deps chromium combines elevated privileges with an unpinned remote package resolution path. If the resolved package were malicious or compromised, it would execute in a privileged context, materially increasing system risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The video-recording example encourages capturing browser sessions without warning that sessions may include credentials, personal data, tokens, or other sensitive on-screen content. In automation contexts, such recordings are often stored or shared, turning transient secrets into durable artifacts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The authentication examples show storing cookies, local storage tokens, and serialized auth state to disk without emphasizing that these artifacts may contain reusable session credentials. If copied, logged, or committed, they can enable account takeover or unauthorized access to protected services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The upload/download examples omit warnings that local files may be exfiltrated to remote sites and that downloaded content written to disk may be malicious or sensitive. In an agent setting, these operations can bridge local filesystem data and untrusted web content with little operator visibility.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The example hard-codes locale: 'ru-RU', timezoneId: 'Europe/Moscow', and Moscow geolocation, which imposes a specific regional profile. The policy allows locale constraints only when the user is given a choice or the constraint is clearly justified, neither of which is present here.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation recommends modifying sudoers to permit passwordless root execution of Playwright installation commands. That is dangerous because it expands privilege boundaries for a browser automation skill and creates a pathway for persistent system modification or abuse if those commands are invoked unexpectedly or compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The sudoers rule allows npx playwright install-deps * without a pinned version, effectively granting passwordless root execution for a command path that can resolve changing package content. This creates a stronger privilege-escalation and supply-chain exposure than a normal unprivileged npx example.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

Allowing npx playwright install * via sudoers without version pinning grants privileged execution to a mutable package-resolution mechanism. That significantly raises the impact of a package compromise or command misuse, because root-level browser/package installation can alter system state broadly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.