Playwright Pro 2.1.1

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:13 AM UTC
• Version: 1.0.0

Overview

This is a coherent Playwright testing toolkit, but it has review-worthy risks around automatic external reporting, credentialed integrations, and unguarded writes to TestRail/BrowserStack.

Install only in repositories where running Playwright tests, writing test files, and using optional TestRail/BrowserStack/Slack integrations is acceptable. Use low-privilege API tokens, keep these integrations disabled unless needed, verify TESTRAIL_URL and SLACK_WEBHOOK_URL before reporting, avoid production-like data in test output, and prefer lockfile-pinned local Playwright/tsx invocations over bare npx.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: skills/report/SKILL.md:45

Finding

Automatic Disclosure of Test Results to an Unvalidated Webhook

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: integrations/testrail-mcp/src/client.ts:16

Finding

TestRail API Credentials Sent to an Unvalidated Configurable Origin

Content

View full analysis

( method: string, endpoint: string, body?: unknown, ): Promise { const url = `${this.baseUrl}/index.php?/api/v2/${endpoint}`; const options: RequestInit = { method, headers: this.headers, }; if (body) { options.body = JSON.stringify(body); } const response = await fetch(url, options); if (!response.ok) { const errorText = await response.text(); throw new Error( `TestRail API error ${response.status}: ${errorText}`, ); } return response.json() as Promise; } ``` ### Technical Analysis The TestRail MCP integration obtains its destination from `TESTRAIL_URL` and constructs a Basic Authentication header containing the TestRail username and API key. The URL is only modified to remove trailing slashes; its scheme, hostname, port, and network destination are not validated. Base64 is an encoding mechanism, not encryption. If an HTTP URL is configured, the username and API key can be observed in transit. If the configured URL points to an attacker-controlled host, that host directly receives the `Authorization` header. A local or internal URL could also cause an authenticated request to an unintended service. This network access is necessary for TestRail s ...[truncated 1540 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (89)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Claiming a broad toolkit while only implementing TestRail schemas or narrow integration logic can mislead users into overtrusting the skill and granting it broader operational latitude. Even when the hidden behavior is not overtly malicious, inaccurate packaging erodes auditability and increases the chance of inappropriate data access.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Claiming a broad toolkit while only implementing TestRail schemas or narrow integration logic can mislead users into overtrusting the skill and granting it broader operational latitude. Even when the hidden behavior is not overtly malicious, inaccurate packaging erodes auditability and increases the chance of inappropriate data access.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Claiming a broad toolkit while only implementing TestRail schemas or narrow integration logic can mislead users into overtrusting the skill and granting it broader operational latitude. Even when the hidden behavior is not overtly malicious, inaccurate packaging erodes auditability and increases the chance of inappropriate data access.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

Claiming a broad toolkit while only implementing TestRail schemas or narrow integration logic can mislead users into overtrusting the skill and granting it broader operational latitude. Even when the hidden behavior is not overtly malicious, inaccurate packaging erodes auditability and increases the chance of inappropriate data access.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · templates/api/auth-headers.md (reported line 55)May include surrounding context.

md

expect(body.error ?? body.code).toMatch(/token.*expired|expired_token/i);
  });

  // Happy path: refresh token obtains new access token
  test('refreshes expired token and retries request', async ({ request }) => {
    // Step 1: refresh
    const refresh = await request.post('{{apiBaseUrl}}/auth/refresh', {

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

The DELETE test performs a destructive request using fully templated parameters such as apiBaseUrl, entityName, and deletableEntityId, with no validation or restriction on what resource is targeted. In this skill context, that makes misuse more dangerous because the template is designed for direct execution in browser automation/test pipelines, where pointing at the wrong environment or ID could delete real data at scale.

Content

Scanner excerpt · templates/api/rest-crud.md (reported line 78)May include surrounding context.

md

});

  // Happy path: DELETE removes entity
  test('DELETE /{{entityName}}s/:id deletes entity', async ({ request }) => {
    const del = await request.delete(`{{apiBaseUrl}}/{{entityName}}s/{{deletableEntityId}}`, { headers });
    expect(del.status()).toBe(204);
    // Verify gone

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README promotes TestRail and BrowserStack integrations and says they can read cases, push results, and pull reports, but it does not clearly warn that using these commands may send test metadata, results, screenshots, videos, URLs, and possibly sensitive application data to third-party services. In a testing skill, this is especially relevant because generated or debugged tests often operate against pre-production systems containing internal identifiers, credentials, or customer-like data.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill advertises capabilities that involve environment variables and external services, but it declares no explicit tool scope or permission boundaries. That makes it easier for an agent to access credentials or perform network actions without clear user-visible constraints, increasing the risk of unintended secret use or outbound data transmission.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly references syncing with TestRail and running on BrowserStack using API credentials, but it does not clearly warn that test data, metadata, or results may be transmitted to third-party services. In this context, users may expose internal project names, URLs, failures, or other sensitive QA artifacts without realizing the privacy and credential-handling implications.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The agent instructs execution of npx playwright test ..., which can resolve and run a package version at execution time if Playwright is not already installed locally. That creates a supply-chain risk and undermines reproducibility, because the behavior depends on whatever version is currently fetched or available in the environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

This repeated use of npx playwright has the same issue: it may implicitly fetch and execute an unpinned package version from the registry. In an agent that is explicitly allowed to use Bash and run tests, this increases the practical exploitability of dependency confusion, registry compromise, or unexpected version drift.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

Using bare npx playwright for the isolation check can cause the agent to execute code from a version not reviewed with the skill. Because the command is presented as routine debugging workflow, users or agents may run it automatically, making the supply-chain exposure more dangerous in this context than in static documentation alone.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The full-suite command again relies on npx playwright without version pinning, exposing the environment to unreviewed package resolution at runtime. Since full-suite runs are likely to be performed in CI or privileged developer environments, compromise could affect broader codebases, secrets, or build infrastructure.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The trace-capture step also uses unpinned npx playwright, preserving the same supply-chain and non-reproducibility risk. The skill context makes this more dangerous because the file is an operational agent playbook with Bash access, so these commands are intended to be executed rather than merely discussed.

Content

No source excerpt is available for this finding.

Bundled hooks can execute when matching lifecycle events occur.

Medium

• Category: Bundled Execution Surface
• Confidence: 95% confidence

Finding

This skill defines bundled lifecycle hooks that automatically execute shell commands on SessionStart and after Write/Edit tool use. Even though the JSON itself only references local scripts, automatic command execution increases attack surface because those scripts run without per-use user review and could perform unintended actions if the package is tampered with or the scripts are unsafe.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code constructs a Basic Authorization header from the BrowserStack username and access key and uses it for outbound API calls. The file contains no confirmation prompt, user-facing log/print, or explanatory comment/docstring warning that credentials and session/build data will be sent to BrowserStack.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The tool explicitly exposes detailed BrowserStack session data, including video URLs, logs, and screenshots, and returns it directly to the caller without any access control, redaction, or warning about sensitive contents. In a testing context, these artifacts commonly contain application data, URLs, credentials, tokens, PII, or internal environment details, so broad retrieval materially increases data exposure risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The browserstack_get_logs tool returns raw session logs directly as text with no filtering or warning, even though test logs frequently include stack traces, URLs, headers, cookies, access tokens, test credentials, and user data. Because this skill is designed for browser automation and CI/test operations, the likelihood of sensitive material appearing in logs is relatively high, making this more dangerous in context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code constructs a Basic Authorization header from the configured user and API key and then sends HTTP requests to a remote TestRail server. The file contains no confirmation prompt, warning comment, or user-facing log indicating that credentials and request payload data will be transmitted over the network.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The shebang uses env npx tsx, which resolves and may fetch an unpinned package at execution time instead of invoking a project-pinned binary directly. In environments where PATH, npm registry configuration, or package resolution can be influenced, this creates supply-chain risk and can lead to execution of an unexpected tsx version or malicious package.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This MCP server exposes state-changing operations like adding cases, updating cases, creating runs, and posting results with no user-facing confirmation, dry-run mode, or explicit guardrails. In an agent context, a mistaken prompt, tool-selection error, or prompt-injection-induced action could silently modify TestRail data, causing integrity issues in test management and reporting.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The example persists authenticated browser session state to .auth/user.json, which can contain cookies, tokens, and other session artifacts that grant access if copied or committed. In a testing toolkit context this is a common technique, but presenting it without an explicit warning about secret handling, file permissions, and .gitignore increases the chance that users will expose reusable credentials or privileged sessions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.