ClawHub
Back to skill

Security audit

playwright-browser-use

Security checks for vulnerabilities and agentic risk

Overview

This is a transparent but very powerful local browser automation skill whose sensitive session features are disclosed and locally guarded, but it should only be used with trusted agents or safer modes enabled.

Install this only for a local, visible browser session where you trust the agent driving it. Use PW_BROWSER_SAFE_MODE=1 for untrusted or semi-trusted callers, and PW_BROWSER_CRED_PERSIST=off if session cookies or localStorage must never be written to disk. Treat exported cookie/storage files like passwords, delete them when done, and avoid using the skill on banking, email, admin, or other high-privilege logged-in sites unless each action is explicitly intended.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding
The skill explicitly exposes powerful capabilities: shellable Node execution, arbitrary browser/network access, persistent authenticated browser state, page-context JavaScript execution, and direct cookie/localStorage import/export. Although the document is transparent about these risks and describes mitigations, there is no built-in fine-grained permission model, so an agent invoking this skill in default mode can abuse user sessions and perform high-impact actions on authenticated sites.

Session Persistence

Medium
Category
Rogue Agent
Content
### G. Cookies and local storage (first-class commands)
- `cookies list|export|import|clear|set`: read/write the current context's cookies, no more `eval` workarounds.
- `storage get|set|clear|export|import`: read/write based on `localStorage`.
- Typical use: `cookies export` after login to back up the session, `cookies import` next time to skip re-login.
- 📁 **Path confinement (operator-gated):** `export`/`import` are confined to `~/.pw-browser/` by default (so credentials can't be scattered into `/tmp` or loaded from attacker-controlled paths elsewhere; paths are resolved through `realpath`, so symlinks can't escape). Since v1.3.8 the confinement **cannot be waived by the caller**: escaping it requires **both** ① the operator starting the daemon with `PW_BROWSER_ALLOW_UNSAFE_CRED_PATH=1`, and ② the caller passing `--unsafe`. `--unsafe` alone returns `UnsafeOverrideNotPermitted`. Responses carry `confined` and `warning` fields, and every credential-path access is logged to the daemon's stderr.
- 🔒 **Session-persistence risk (Rogue Agent / Medium):** `export`/`import` let the login state be written to disk and restored across runs — convenient, but a rogue/misbehaving agent can use it for **privilege persistence**. Treat exported session files as secrets: delete when done; if kept, just leave them under `~/.pw-browser/` — since v1.3.9 that directory is created `0700` and both credential dumps and the daemon token file are written `0600`, so no manual `chmod` is needed (on Windows POSIX mode bits aren't enforced; user-profile ACLs apply). To forbid credentials on disk entirely, start the daemon with `PW_BROWSER_CRED_PERSIST=off`: `export`/`import` are **blocked** (`CredentialPersistenceDisabled`) while `list`/`get`/`set`/`clear` keep working — finer-grained than safe mode, for long-running agents that need full automation but must not leave restorable sessions behind. `cookies clear` / `storage clear` and `shutdown` the daemon when not needed (idle auto-exit defaul
...[truncated 25 chars]
Confidence
93% confidence
Finding
The documentation explicitly advertises exporting and importing cookies/localStorage to persist authenticated browser sessions across runs. Even with confinement, file-permission hardening, and optional disable flags, this capability materially enables credential theft, replay, and privilege persistence if a rogue agent, local malware, or another local user gains access to the saved session artifacts or invokes the feature inappropriately.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
pw-browser.js:1028