playright-cli-zh

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:28 AM UTC
• Version: 1.0.0

Overview

This is a legitimate browser automation skill, but it needs review because it can access, save, and alter sensitive browser session data and installs mutable npm tooling.

Install only if you want an agent to have broad browser automation authority. Use test accounts where possible, avoid real payment or secret-bearing flows during tracing or video capture, do not print or persist cookies/tokens unless necessary, delete auth-state files after use, and prefer pinned project-local npm dependencies over global latest installs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:325

Finding

Execution of Unpinned npm Packages Through Mutable latest Tags

Content

View full analysis

Vulnerability Details

File Locations:

• SKILL.md:325
• references/spec-driven-testing.md:27-30

Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code:

bash

npm install -g @playwright/cli@latest

bash

# If there is no Playwright install, bootstrap one and let the user pick the defaults:
npm init playwright@latest

Technical Analysis

Both commands resolve the mutable npm latest distribution tag rather than a reviewed, exact package version.

npm install -g @playwright/cli@latest downloads and globally installs whichever release currently owns the tag. Installation can execute package lifecycle scripts with the privileges of the invoking user. Because the installation is global, a compromised package may also modify globally available executables or files outside the project workspace.

npm init playwright@latest downloads and executes the currently published Playwright initializer. The initializer can create files, modify project configuration, and introduce additional dependencies. The instructions do not require a lockfile, integrity validation, provenance checking, lifecycle-script review, or an exact version.

These commands are legitimate installation mechanisms, and the audit found no evidence that the currently referenced packages are malicious. The vulnerability is the unsafe trust placed in future, mutable package releases.

Attack Path

1. An attacker compromises the npm publisher account, package release process, or a transitive dependency.
2. The attacker publishes a malicious release and causes the mutable latest tag to resolve to it.
3. A user or agent follows the Skill instructions and runs one of the affected commands.
4. npm downloads the changed package without enforcing a previously reviewed version.
5. Malicious initializer or lifecycle code executes with the invoking user's privileges.
6. The payload m ...[truncated 798 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace mutable tags with reviewed exact versions, for example:

   bash

   npm install --save-dev --save-exact @playwright/cli@REVIEWED_VERSION
   npm init playwright@REVIEWED_VERSION
   

2. Prefer project-local dependencies over global installation to limit the affected scope and make dependency resolution reproducible.

3. Commit an npm lockfile and use npm ci in automated environments.

4. Validate package provenance, integrity metadata, publisher identity, and lifecycle scripts before approving version upgrades.

5. Consider initially installing with lifecycle scripts disabled where compatible:

   bash

   npm install --ignore-scripts --save-dev --save-exact @playwright/cli@REVIEWED_VERSION
   

   Any required scripts should be reviewed before being run separately.

6. Execute package installation in a restricted, non-privileged environment with minimal filesystem access and without unnecessary credentials.

7. Use automated dependency scanning and an explicit update-review process rather than automatically tracking latest.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (30)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Saving browser authentication state to a local file without warning is particularly dangerous because storage state commonly includes session cookies and other credentials that can enable account takeover if reused. In a general-purpose automation skill, this capability is more dangerous because it is framed as a simple convenience example rather than a sensitive security operation.

Content

No source excerpt is available for this finding.

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/storage-state.md (reported line 273)May include surrounding context.

md

- Never commit storage state files containing auth tokens
- Add `*.auth-state.json` to `.gitignore`
- Delete state files after automation completes
- Use environment variables for sensitive data
- By default, sessions run in-memory mode which is safer for sensitive operations

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The example shows tracing enabled while entering payment-card-like data, meaning the resulting trace could store card numbers, expiry dates, CVV-like values, screenshots of payment pages, and associated network payloads. This materially increases the chance of collecting PCI-regulated or otherwise highly sensitive financial data in logs and trace files, which could be exposed through local storage, sharing, or insufficient access controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly documents listing, reading, setting, and clearing cookies, localStorage, and sessionStorage, including session identifiers, without any warning that these values often contain credentials or authenticated session material. In an agent setting, this increases the risk of accidental secret extraction, leakage into logs, or unsafe manipulation of live authentication state.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

bash

playwright-cli route "**/*.jpg" --status=404
playwright-cli route "https://api.example.com/**" --body='{"mock": true}'
playwright-cli route-list
playwright-cli unroute "**/*.jpg"
playwright-cli unroute

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The example TOKEN=$(playwright-cli --raw cookie-get session_id) normalizes extracting a session cookie directly into a shell variable with no caution about credential handling. Session IDs are often bearer tokens; exposing or reusing them can enable account takeover, lateral movement, or leakage through shell history, subprocess environments, and logs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Commands like delete-data and kill-all are destructive and can erase browser state or terminate unrelated browser processes, yet the documentation provides them without caution. In an automated agent workflow, this raises the chance of accidental data loss, interruption of active user work, or disruption of debugging and testing environments.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation explicitly exposes execution of arbitrary Playwright function expressions, which materially expands the skill from simple browser automation into unrestricted code-driven browser control. In this context that can be abused to manipulate permissions, access sensitive page/browser state, interact with authenticated sessions, and perform privacy-sensitive actions without any safety boundaries or warnings.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation demonstrates granting clipboard-read and reading clipboard contents without any warning that clipboard data may contain sensitive user information such as passwords, tokens, or confidential text. Presenting this as routine usage lowers the barrier to privacy-invasive behavior in a tool that already has browser/session access.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The example shows saving authenticated browser storage state to auth.json, which can capture session cookies and tokens that enable account/session reuse if the file is exposed. Because this persists authentication material to disk, it creates a clear credential-handling risk beyond ordinary web testing behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The file documents kill-all as forcefully killing all daemon processes, but it does not provide an explicit warning that this may interrupt active browser sessions, terminate in-progress automation, or risk loss of unsaved state. For markdown guidance covering system-impacting behavior, a direct warning should accompany forceful termination instructions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file documents delete-data commands that remove browser session user data and profile directories, but it does not explicitly warn that the action is destructive and may permanently erase cookies, storage, history, and other persisted state. Because this is user-facing documentation for a data-affecting operation, the omission is a meaningful safety warning gap.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation explains how to persist browser profiles to disk, but it does not warn that doing so stores browsing state such as cookies and local data on the filesystem. Because this behavior can affect privacy and leave recoverable session artifacts, the skill description should disclose it explicitly.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

At L164 the document states generation must run 'never in parallel' because scenarios share the seed session. At L223 it later says the same process is 'safe to parallelise', which is a direct contradiction in the file's operational guidance rather than a mere omission.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.