Security audit

playwright-download-fix

Security checks for vulnerabilities and agentic risk

Overview

This download helper is mostly purpose-related, but it needs Review because it weakens browser protections and writes untrusted downloaded filenames without safe path checks.

Review before installing. Use this only in a controlled Playwright workflow, remove bypassCSP and stealth-style settings unless you have a specific test need, avoid logged-in sensitive browsing in the provided standalone script, pin dependencies, and sanitize suggested download filenames so files cannot escape the chosen download directory or overwrite existing files.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: download-helper.js:52
Finding: Untrusted Download Filename Allows Path Traversal and Arbitrary File Overwrite
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: standalone-script.js:21
Finding: Browser Content Security Policy Is Unnecessarily Disabled
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The Chinese-language description similarly understates the skill by framing it as a filename fix while the content includes automated navigation to a specific recruitment site, anti-detection configuration, CSP bypass, and manual-login session handling. In context, this broadens the skill from benign download handling into stealth-oriented browser automation against third-party services.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The Chinese-language description similarly understates the skill by framing it as a filename fix while the content includes automated navigation to a specific recruitment site, anti-detection configuration, CSP bypass, and manual-login session handling. In context, this broadens the skill from benign download handling into stealth-oriented browser automation against third-party services.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill documentation is written entirely in Chinese, including usage instructions and behavior descriptions, with no indication that other languages are supported or that the language choice is intentional and justified. This creates a natural-language locale constraint without user opt-in, which matches the policy-violation category for language/locale restrictions.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill documents code execution and environment-dependent behavior but does not declare any explicit tool scope or permissions boundary. This is dangerous because users and orchestration systems cannot accurately constrain what the skill is allowed to do, increasing the chance of unintended file writes, shell usage, or automation actions beyond the stated purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill does not prominently warn that it automatically saves downloaded content into a user directory, which can lead to silent persistence of untrusted files on the host. In a browser automation context, automatic writes to ~/downloads increase exposure to accidental storage of malicious or sensitive content without sufficient user awareness.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 79% confidence
Finding: Using npx playwright without pinning a version makes the installation and runtime behavior non-reproducible and exposes users to supply-chain risk if a newer or compromised package version is resolved. In a skill that drives browsers and handles downloads, unexpected dependency changes can materially alter security posture or introduce malicious code.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Forcing Chinese locale and China timezone by default without opt-in is not a direct exploit, but it is a risky hidden behavior because it changes browser fingerprinting and request context in ways users may not expect. In combination with the other anti-detection settings, it supports stealthier automation and can create misleading site interactions or compliance issues.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation expands a simple filename-correction utility into a broader browser automation setup with realism/anti-detection tuning. That makes the skill more dangerous in context because users may invoke it expecting safe local download handling, while it is actually designed to alter browser fingerprinting and relax protections such as CSP.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Documenting bypassCSP: true is unjustified for a skill whose stated purpose is only to preserve original download filenames. Disabling or bypassing CSP weakens a browser security control and can enable injection or script execution paths that would otherwise be constrained.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The troubleshooting section gives advice for bypassing automation detection, including stealth tooling and connecting to a real Chrome instance, which is unrelated to basic filename correction. This is dangerous because it normalizes evasion techniques that can facilitate automation against sites that intentionally restrict or monitor bot access.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This JavaScript file contains natural-language comments and console output exclusively in Chinese, including the top-level description and parameter documentation. Under the policy, forcing a specific language without user opt-in or a clearly justified region-specific scope is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The dispose() method calls removeAllListeners('download'), which removes every download listener registered on the Playwright page, not only the one created by this helper. In a shared automation context, this can silently disable security-relevant or application-critical handlers in other components, causing loss of auditing, policy enforcement, or expected workflow behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The Playwright context is hard-coded to use locale: 'zh-CN' and timezoneId: 'Asia/Shanghai'. This imposes a specific language/locale setting without any visible user choice or documented justification, which matches the policy-violation criteria for locale forcing.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The browser context is configured with anti-detection style settings such as a spoofed Chrome user agent and bypassCSP, even though those controls are not necessary to solve a filename preservation issue. These settings can weaken site security assumptions, obscure automation, and make the skill suitable for stealthy interaction with external services beyond its advertised scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The browser context is hard-coded to use zh-CN locale and Asia/Shanghai timezone. This imposes a specific language/locale setting without any user opt-in or documented region-specific justification, which matches the policy-violation category for forced locale behavior.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill claims to only fix Playwright download filenames, but it also hard-codes navigation to an external site and leaves an interactive browser session open for 30 minutes for manual login and use. This creates undisclosed behavior that can capture authenticated downloads or facilitate unintended interaction with a third-party service, making the script more dangerous than its stated purpose suggests.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description is written only in Chinese ("自动处理 Playwright 下载文件名问题") with no indication that the skill supports other languages or that Chinese is a justified locale requirement. This can violate language/locale policy because it effectively constrains usage and comprehension to a specific language without user choice.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.