Playwright Browser Use

• Outcome: Review
• Latest audit: Jul 23, 2026 · 6:39 AM UTC
• Version: 1.0.2

Overview

This browser automation skill is disclosed, but it exposes a persistent local control service that can run arbitrary browser and Node-side code without meaningful guardrails.

Install only if you are comfortable giving the skill control of a local browser session and arbitrary code execution authority. Use it on logged-in or sensitive sites only with clear user intent, prefer the structured commands over run-code/eval, close the daemon after use, and review or pin the Playwright dependency before operational use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The manifest and description frame the skill as routine browser automation, but the documented capabilities materially exceed that scope by exposing arbitrary JavaScript execution, arbitrary Playwright code execution, and a persistent local control daemon. This mismatch is dangerous because downstream agents or users may grant trust and invoke the skill under a narrower risk assumption than its actual authority, enabling stealthier data access, page manipulation, and local browser control.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly exposes eval and run-code primitives that allow arbitrary user-supplied JavaScript and Playwright code to execute with access to the active page session. In an agent setting, this greatly expands the attack surface beyond simple browser automation, allowing arbitrary DOM manipulation, credential harvesting from the page context, navigation to attacker-controlled content, and potentially broader abuse through Playwright APIs.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill is described as a browser automation tool, but it also exposes `eval` and `run-code` endpoints that permit arbitrary JavaScript execution. This materially expands capability from bounded UI automation to unrestricted code/script execution in the browser context, creating a dangerous mismatch between declared purpose and actual behavior.

Context-Inappropriate Capability

High

• Confidence: 100% confidence
• Finding: `new Function('page', ...)` executes attacker-controlled code strings with access to the Playwright `page` object, enabling arbitrary browser actions and data access. If an agent or untrusted caller can reach this command, they can bypass all intended safety boundaries and perform unrestricted automation, exfiltration, or destructive actions.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The `eval` command allows arbitrary expressions to be executed in page context, including element-scoped `eval(expr)`. Even though this is limited to the browser/page environment rather than Node.js, it still enables arbitrary DOM access, data extraction, page manipulation, and execution of unintended logic beyond the stated high-level automation scope.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The documentation explicitly exposes a `run-code` interface that executes arbitrary Playwright/Node-side code in the daemon context, which is materially broader than ordinary bounded browser actions like click, type, or screenshot. In a browser automation skill, this expands the attack surface from constrained automation to general-purpose code execution against the active browser session, enabling data extraction, unsafe navigation flows, and other powerful actions without clear guardrails.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The examples show users can supply arbitrary code strings for execution, including `page.evaluate`, navigation logic, downloads, storage access, and form submission. That is effectively an unrestricted programmable execution primitive inside a privileged browser automation environment, which can be abused to access session data, manipulate authenticated pages, or perform unintended side effects.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation encourages arbitrary code execution in the browser context without warning that such code can alter page state, submit forms, trigger transactions, or extract sensitive page data. In a browser automation skill, omitting that warning increases the chance an agent uses these commands inappropriately or more broadly than the user intended.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The SPA/RTE section provides concrete instructions for editing and saving content in authenticated web applications, but it does not clearly warn that these actions can persistently modify user data or publish changes. In an agent environment, that omission can lead to unintended destructive or unauthorized edits to knowledge bases, CMS pages, or documents.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The arbitrary execution features are not merely underdocumented; they introduce a materially dangerous capability that lets callers run custom code against the browser session. In an agent skill context, this is especially risky because higher-level systems may trust the skill as simple browser automation while it can actually execute attacker-supplied logic and extract or alter sensitive data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This guide explicitly instructs the agent to focus a contenteditable rich-text editor, select all existing content, type replacement text, and then click a save/publish button, but it does not require confirmation that the target is a safe draft or that destructive modification is intended. In a browser automation skill for live knowledge bases, CMS pages, and document systems, these steps can overwrite production content or publish unintended changes, making the omission operationally dangerous.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The file presents arbitrary code execution as a normal feature without any safety warning, despite the fact that such code can inspect page content, extract browser state, and trigger side effects. Lack of warning increases the likelihood that users or downstream agents invoke dangerous capabilities without understanding the security implications.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The download example writes a file to local disk via `saveAs('./downloaded-file.pdf')` without warning that this causes filesystem side effects. In agentic settings, silent local writes can overwrite files, stage unwanted content, or facilitate follow-on abuse if users assume the skill is limited to in-browser actions.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The form submission example performs a real submit flow and waits for a success URL, demonstrating a potentially irreversible external action without cautionary language. In authenticated or production contexts, such submissions could create records, send messages, place orders, or otherwise change state unintentionally.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"private": true,
  "description": "Playwright-based browser automation CLI skill",
  "dependencies": {
    "playwright": "^1.51.0"
  }
}

• Confidence: 92% confidence
• Finding: "playwright": "^1.51.0"

Known Vulnerable Dependency: playwright==1.51.0 — 1 advisory(ies): CVE-2025-59288 (Playwright downloads and installs browsers without verifying the authenticity of)

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: playwright==1.51.0

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: pw-browser.js:431