ClawHub
Back to skill

Security audit

Playwright Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is a plausible Playwright automation helper, but it gives broad browser action authority and includes under-scoped handling of temp scripts and global request headers that users should review before installing.

Install only if you intend to let the agent run real browser automation. Prefer staging sites and test accounts, confirm before any login or form submission on live services, avoid putting secrets in global PW_HEADER_NAME/PW_HEADER_VALUE or PW_EXTRA_HEADERS for untrusted origins, and use private randomized temp paths instead of predictable /tmp filenames when running generated scripts.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:22
Finding

Predictable Shared Temporary Paths Permit Symlink and Race Attacks

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:22
Vulnerability Type: Predictable temporary-file usage
Risk Level: Medium

Vulnerable Code

markdown
2. **Write scripts to /tmp** - NEVER write test files to skill directory; always use `/tmp/playwright-test-*.js`

The document also supplies predictable examples such as /tmp/playwright-test-page.js, /tmp/screenshot.png, and /tmp/quick-screenshot.png, which are subsequently written or executed.

Technical Analysis

The Skill mandates storing executable JavaScript and browser artifacts directly in the shared /tmp directory using predictable names. It does not require a private randomized directory, exclusive file creation, ownership validation, restrictive permissions, or protection against symbolic links.

On a multi-user system, another local process can predict these paths and pre-create a symbolic link or race the agent between file creation and execution. For executable test files, an attacker may replace or redirect the script before it is passed to node run.js. For screenshots and other output files, a symbolic link may redirect the write to another file writable by the agent.

Exploitation requires local access to the same host and permission to create entries in the shared temporary directory.

Attack Path

  1. The attacker observes the documented naming convention or predicts a filename such as /tmp/playwright-test-page.js.
  2. The attacker creates that path as a symbolic link, or repeatedly replaces it during the interval between the agent writing and executing the file.
  3. The agent follows the Skill instructions and writes a generated script to the predictable path.
  4. The agent executes that path through node run.js.
  5. Depending on the race outcome, attacker-controlled JavaScript may execute with the agent's privileges, or the generated content may be redirected to another writable target.
  6. A similar pre-creation att ...[truncated 639 chars]
Remediation
View remediation

Remediation Suggestions

  • Create a private randomized working directory with fs.mkdtemp() rather than placing files directly under predictable /tmp paths.
  • Set directory permissions to 0700 and script permissions to 0600.
  • Create files atomically with exclusive-create semantics such as O_CREAT | O_EXCL.
  • Reject symbolic links and verify file ownership and type with lstat() before writing or executing a file.
  • Keep an open file descriptor from creation through writing where possible to reduce time-of-check/time-of-use races.
  • Generate cryptographically random filenames for scripts, screenshots, traces, and downloads.
  • Delete the private directory and all generated artifacts explicitly after execution.
  • Do not execute a temporary script if its ownership, permissions, inode, or resolved path changes after creation.

T08 · Insecure Dependencies

Note
Location
API_REFERENCE.md:634
Finding

Unpinned npx Commands May Download and Execute Mutable Package Code

Content
View full analysis

Vulnerability Details

File Location: API_REFERENCE.md:634-646
Vulnerability Type: Unpinned third-party command execution
Risk Level: Low

Vulnerable Code

bash
# Run tests
npx playwright test

# Run in headed mode
npx playwright test --headed

# Debug tests
npx playwright test --debug

# Generate code
npx playwright codegen https://example.com

# Show report
npx playwright show-report

The document also recommends npx playwright install --with-deps in the CI example at line 570.

Technical Analysis

The commands invoke npx playwright without --no-install, an explicitly pinned package version, or a documented lockfile requirement. If a suitable local executable is unavailable, npx may resolve and download package content from the configured npm registry before running it.

This makes execution dependent on mutable external package resolution at invocation time. A compromised registry account, registry configuration, package release, or dependency chain could therefore introduce code that was not present during review. Although the package name is the legitimate playwright name rather than an apparent typosquat, the absence of version pinning and local-only enforcement creates an avoidable supply-chain risk.

Attack Path

  1. Playwright is absent from the local project, or the local executable cannot be resolved.
  2. A user follows the documented npx playwright ... command.
  3. npx consults the configured package registry and resolves package content at execution time.
  4. The registry package, one of its dependencies, or the registry configuration has been compromised or maliciously redirected.
  5. Downloaded package lifecycle or CLI code executes with the invoking user's permissions.
  6. The malicious code can access resources available to that user before or while the expected Playwright command runs.

Impact Assessment

A successful supply-chain compromise ...[truncated 471 chars]

Remediation
View remediation

Remediation Suggestions

  • Declare Playwright as an exact-version project dependency and commit the package lockfile.
  • Install dependencies with npm ci so resolution is reproducible and lockfile-controlled.
  • Invoke the installed binary with npx --no-install playwright ... or ./node_modules/.bin/playwright ....
  • Pin GitHub Actions and other CI dependencies to immutable commit SHAs where practical.
  • Configure an approved npm registry and enable lockfile integrity verification.
  • Use dependency scanning, provenance verification, and controlled update reviews.
  • Document a failure condition when the local Playwright binary is unavailable rather than allowing an implicit download.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (15)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The documentation explicitly supports automatic injection of custom headers from environment variables into all outbound browser requests, but does not warn that this can disclose internal metadata, identifiers, or secrets to every visited origin. In a browser-automation skill that may navigate to arbitrary user-specified sites, global header injection broadens data exposure and can leak organization-specific values across trust boundaries.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill description is broad enough to match generic web-related requests, not just clearly bounded browser-testing tasks. In an agent environment, that can cause the skill to be invoked for actions that navigate, inspect, or interact with arbitrary sites without strong task scoping, increasing the chance of unintended automation against sensitive or third-party targets.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly supports login flows, form filling, and submission, but does not warn that these actions may change state, submit real data, trigger emails, or modify live systems. In context, Playwright performs real browser actions, so using this skill against production or third-party sites can create unintended transactions or account activity.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The mobile testing example sets locale: 'en-US', which forces a specific locale in natural-language configuration. The document does not indicate that this is only illustrative, provide alternatives, or explain a region-specific requirement.

Content

No source excerpt is available for this finding.

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 449)May include surrounding context.

md
## Notes

- Each automation is custom-written for your specific request
- Not limited to pre-built scripts - any browser task possible
- Auto-detects running dev servers to eliminate hardcoded URLs
- Test scripts written to `/tmp` for automatic cleanup (no clutter)
- Code executes reliably with proper module resolution via `run.js`

Static analysis

No suspicious patterns detected.