Playwright Interactive

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:49 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Playwright debugging helper, but it asks users to disable sandboxing and install runtime dependencies, so it should be reviewed carefully before use.

Install only for trusted local development workspaces. Avoid using it on unknown repositories, pull requests, downloaded Electron apps, or environments with sensitive credentials, and prefer pinned dependencies or an isolated VM/container because the documented workflow disables sandbox protection.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:22

Finding

Playwright Workflow Requires Disabling Sandbox Isolation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 22; reiterated at line 693
Vulnerability Type: Least-privilege violation through unrestricted host access
Risk Level: High

Vulnerable code snippet:

markdown

- For now, run this workflow with sandboxing disabled: start Codex with `--sandbox danger-full-access` (or the equivalent config for `sandbox_mode=danger-full-access`). This is a temporary requirement while `js_repl` + Playwright support inside the sandbox is still being completed.

The same unsafe requirement is repeated in the failure guidance:

markdown

- Browser launch or network operations fail immediately: confirm the session was started with `--sandbox danger-full-access` and restart that way if needed.

Technical Analysis

The Skill explicitly instructs users to disable the Codex sandbox for the entire browser or Electron debugging session. This removes a major isolation boundary while the Agent installs dependencies, launches subprocesses, interacts with local applications, and evaluates JavaScript in browser or Electron contexts.

Browser and Electron debugging legitimately requires access to application processes and project files, but unrestricted host access is broader than those requirements. If the target workspace, application, dependency, or generated command is malicious or compromised, its actions may occur without sandbox restrictions. The warning that this is a temporary compatibility requirement does not provide a compensating security control.

Attack Path

1. A user loads the Skill to test a local web or Electron application.
2. Following SKILL.md, the user restarts Codex with --sandbox danger-full-access.
3. The workflow installs dependencies and launches the target application or development server.
4. A compromised dependency, malicious project startup script, or hostile Electron main process executes during setup or launch.
5. Because sandbox ...[truncated 754 chars]

Remediation

View remediation

Remediation Suggestions

• Keep sandboxing enabled by default and grant only the capabilities required for the current test, such as workspace-scoped filesystem access, selected subprocess execution, display access, and loopback networking.
• Run browser or Electron testing in a dedicated container, virtual machine, or disposable operating-system account when sandbox compatibility is unavailable.
• Require explicit, informed user approval before entering an unrestricted mode, clearly identifying the target application and commands that will run.
• Do not use unrestricted mode for untrusted repositories, pull requests, downloaded applications, or projects with unreviewed lifecycle and startup scripts.
• Separate dependency installation and application execution from any environment containing production credentials or sensitive files.
• Restore sandboxed operation immediately when supported rather than documenting danger-full-access as the standard workflow.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:28

Finding

Unpinned Dependencies and Browser Components Are Installed at Runtime

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 28-35
Vulnerability Type: Unsafe third-party dependency acquisition
Risk Level: Medium

Vulnerable code snippet:

bash

test -f package.json || npm init -y
npm install playwright
# Web-only, for headed Chromium or mobile emulation:
# npx playwright install chromium
# Electron-only, and only if the target workspace is the app itself:
# npm install --save-dev electron
node -e "import('playwright').then(() => console.log('playwright import ok')).catch((error) => { console.error(error); process.exit(1); })"

Technical Analysis

The setup instructions install playwright and optionally electron without exact version constraints. They also direct the Agent to invoke npx playwright install chromium, which downloads and installs an external browser component. No reviewed lockfile, exact package version, registry restriction, artifact checksum, or integrity-validation procedure is specified.

Consequently, the code installed during a future Skill invocation may differ from the code available when the Skill was audited. Running these commands in the target workspace can also modify its package manifest and lockfile. The risk is amplified by the separate instruction to operate with danger-full-access.

The identified package names appear appropriate for the declared Playwright functionality; the issue is mutable, unverified runtime acquisition rather than evidence that the named packages are currently malicious.

Attack Path

1. The user invokes the Skill in a workspace where Playwright or Electron is not already installed.
2. The Agent runs the documented npm install or npx command.
3. npm resolves the dependency and its transitive dependency graph from the configured registry at execution time.
4. If the registry, package account, dependency chain, local npm configuration, or future package release is compromised, attacker-controll ...[truncated 760 chars]

Remediation

View remediation

Remediation Suggestions

• Pin Playwright and Electron to exact, reviewed versions rather than resolving the latest available releases.
• Provide and enforce a committed lockfile, and use npm ci for deterministic installation.
• Configure an approved registry and retain npm integrity metadata; verify downloaded browser artifacts using vendor-provided checksums or signatures where available.
• Review transitive dependencies and use dependency scanning before updating pinned versions.
• Disable npm lifecycle scripts during installation where compatible, then explicitly run only required, reviewed setup operations.
• Install tooling in a dedicated QA environment rather than modifying arbitrary target workspaces.
• Perform dependency acquisition inside a sandboxed, containerized, or otherwise isolated environment with minimal credentials and filesystem access.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

Preconditions

• js_repl must be enabled for this skill.
• If js_repl is missing, enable it in ~/.codex/config.toml:

toml

[features]

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill directly instructs operators to run Codex with --sandbox danger-full-access, removing isolation for a workflow that launches browsers/Electron apps, installs packages, accesses local files, and drives arbitrary pages. That materially increases the blast radius of any prompt injection, malicious workspace content, compromised dependency, or accidental destructive action from the agent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The skill describes powerful browser/Electron debugging capabilities but does not clearly bound when it should and should not be used. In combination with persistent REPL state, local process launch, and screenshot/click automation, vague activation scope increases the chance an agent applies it in an overly broad context, touching sensitive local apps or data unintentionally.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.