Playwright MCP

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:19 PM UTC
• Version: 1.0.0

Overview

The skill is coherent browser-automation documentation, but it asks users to run mutable npm packages for a powerful browser-control MCP server without enough scoping or data-handling warnings.

Review this before installing. Prefer pinned package versions or a locked local install, use allowed-hosts for trusted sites, avoid --ignore-https-errors except in controlled testing, and treat saved screenshots, traces, videos, and form entries as potentially sensitive.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Third-Party npm Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–21; related package declaration at line 4
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

The skill directs users to install or immediately execute @playwright/mcp without specifying a reviewed version or verifying package integrity.

bash

npm install -g @playwright/mcp
# Or
npx @playwright/mcp

It also invokes another unpinned npm executable:

bash

npx playwright install chromium

The metadata similarly declares the dependency without a version constraint:

yaml

metadata: {"openclaw":{"emoji":"🎭","os":["linux","darwin","win32"],"requires":{"bins":["playwright-mcp","npx"]},"install":[{"id":"npm-playwright-mcp","kind":"npm","package":"@playwright/mcp","bins":["playwright-mcp"],"label":"Install Playwright MCP"}]}}

Technical Analysis

Unversioned npm install and npx commands resolve a mutable package release at execution time rather than a specific artifact reviewed during the skill audit. In particular, npx can download and immediately execute package code. npm installation can also run package lifecycle scripts, while the documented global installation modifies the user's environment.

The project does not supply a lockfile, exact package version, registry restriction, or integrity digest. Consequently, the code executed by a user can differ from the code that existed when the skill was reviewed. No evidence shows that the named packages are currently malicious; the vulnerability is the unsafe supply-chain trust model.

Attack Path

1. An attacker compromises the referenced npm package, its maintainer account, its publishing pipeline, or a resolved transitive dependency.
2. The attacker publishes a malicious or backdoored release under the package name referenced by the skill.
3. A user follows the documented npm install -g @playwright/mcp or npx @playwright/mcp instru ...[truncated 936 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every npm dependency to a reviewed exact version, for example @playwright/mcp@X.Y.Z, rather than relying on the latest published release.
2. Install dependencies locally instead of globally to limit environmental modification and make resolution reproducible.
3. Commit and enforce a lockfile with npm integrity hashes, and use npm ci in automated environments.
4. Invoke only the locally installed binary. If npx is retained, use npx --no-install so it cannot download an unexpected package at runtime.
5. Configure an approved npm registry and validate package provenance, publisher identity, signatures or attestations, and integrity before upgrades.
6. Pin and verify browser artifacts installed by Playwright where supported.
7. Run the MCP server in a sandbox or container with least-privilege filesystem and network access.
8. Establish a controlled dependency-update process that includes release review, vulnerability scanning, and testing before changing pinned versions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill documents shell-based installation and execution of an MCP server but does not declare an explicit tool scope such as permissions or allowed-tools. In an agent setting, this weakens least-privilege controls and can cause the skill to be invoked with broader shell capability than users expect, increasing the chance of unintended command execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill description advertises browser automation but does not warn that typed data can be sent to external websites and forms can be submitted. In this context, omission matters because users may provide credentials, personal data, or internal information without realizing the skill can transmit it off-host.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Using npx @playwright/mcp without a pinned version causes execution of whatever package version is current at run time. This creates a supply-chain risk: a compromised upstream release or breaking update could execute unreviewed code on the user's machine when the skill is used.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

Using npx playwright without version pinning for browser installation pulls the latest package at execution time. That exposes users to supply-chain compromise or unexpected behavior changes from an unreviewed upstream release.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Starting the MCP server with unpinned npx @playwright/mcp executes a remote package version selected at runtime. In a browser automation skill, that is especially sensitive because the package can drive navigation, form submission, and data extraction on behalf of the user.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The unpinned headless startup example allows execution of whatever current @playwright/mcp release is served by the registry. Because this server can automate browser actions, a malicious or compromised release could abuse network access and interact with external sites.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The Firefox example still relies on an unpinned npx @playwright/mcp invocation, preserving the same supply-chain execution risk. The browser choice does not reduce the danger because the package itself runs locally with the user's privileges.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The viewport example uses floating npx @playwright/mcp, which means runtime behavior depends on the latest upstream release. In an MCP server context, this can silently change exposed browser capabilities or introduce malicious code.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The --ignore-https-errors example combines a floating package invocation with a flag that weakens TLS protections. That context makes the unpinned dependency more dangerous because it normalizes both supply-chain risk and insecure browser transport behavior in the same workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The output configuration mentions screenshots, traces, videos, and output directories without warning that these artifacts may capture sensitive page content, credentials, tokens, or personal data and store them locally. Because this skill is explicitly designed for web interaction and extraction, local artifact retention significantly increases privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The troubleshooting command npx playwright install chromium is also unpinned and executes the latest Playwright package. Even in troubleshooting sections, floating execution instructions can introduce unreviewed code onto the host.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The debug-mode startup command again uses an unpinned MCP package, exposing users to supply-chain execution risk during investigation workflows. Debug mode may additionally emit more data, making compromise or unexpected behavior more visible and potentially more harmful.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.