Playwright Cli

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:34 AM UTC
• Version: 0.1.9

Overview

This is a coherent browser automation skill, but it gives agents broad browser/session power and recommends an unpinned global npm install, so users should review it carefully before installing.

Install only if you intentionally want an agent to control browser sessions, inspect or modify cookies/storage, run Playwright code, and create traces/videos. Prefer a project-local, lockfile-pinned Playwright CLI instead of the documented global @latest install, avoid production accounts and real payment data, and delete or protect auth-state, trace, video, screenshot, profile, and download files after use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:309

Finding

Mutable Global Installation of an Unpinned Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 309-320
Vulnerability Type: Unsafe third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash

## Installation

If global `playwright-cli` command is not available, try a local version via `npx playwright-cli`:

npx --no-install playwright-cli --version

When local version is available, use `npx playwright-cli` in all commands. Otherwise, install `playwright-cli` as a global command:

npm install -g @playwright/cli@latest

Technical Analysis

The fallback procedure installs @playwright/cli globally using the mutable latest distribution tag. Although the project metadata declares compatibility with @playwright/cli version ^1.51.0, this command can retrieve an arbitrary future release that was not covered by this audit.

An npm installation may execute package lifecycle scripts under the privileges of the invoking user. The global installation also increases the affected scope beyond this project and may replace or alter tooling available to other projects. If the upstream account, package, release pipeline, or npm distribution channel is compromised, following this instruction could execute unreviewed code.

Attack Path

1. The audited environment does not have a usable local or global playwright-cli.
2. The Agent follows the documented fallback installation procedure.
3. npm resolves @playwright/cli@latest to the release currently associated with the mutable tag.
4. A compromised or malicious release is downloaded.
5. Package installation and any applicable lifecycle behavior execute with the invoking user's permissions.
6. The package becomes globally available and can affect subsequent commands or other projects using the same executable name.

Impact Assessment

Successful exploitation could execute arbitrary code with the invoking user's privileges. The accessible scope may include the user's files, environment variables, browser artifa ...[truncated 289 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest with an exact, reviewed version such as @playwright/cli@1.51.0.
• Install the dependency locally in the project rather than globally.
• Commit and enforce a lockfile containing integrity hashes.
• Use npm ci for reproducible installation.
• Invoke the verified local package with npx --no-install.
• Disable lifecycle scripts during installation when they are unnecessary, for example with npm ci --ignore-scripts, after confirming compatibility.
• Upgrade only through a controlled dependency-review process that verifies package provenance, release notes, integrity, and expected behavior.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/tracing.md:93

Finding

Sensitive Payment Data Is Entered While Detailed Tracing Is Enabled

Content

View full analysis

Vulnerability Details

File Location: references/tracing.md, lines 93-103
Vulnerability Type: Plaintext sensitive data exposure in diagnostic artifacts
Risk Level: Medium

Vulnerable Code

bash

### Capturing Evidence

# Record a complete user flow for documentation
playwright-cli tracing-start

playwright-cli open https://app.example.com/checkout
playwright-cli fill e1 "4111111111111111"
playwright-cli fill e2 "12/25"
playwright-cli fill e3 "123"
playwright-cli click e4

playwright-cli tracing-stop
# Trace shows exact sequence of events

The same document explains that trace artifacts include actions, DOM snapshots, screenshots, console messages, and complete network activity, including request and response headers and bodies.

Technical Analysis

The example enables detailed tracing before entering a card number, expiration date, and CVV. Even though the displayed values appear to be test data, this pattern encourages users or Agents to trace equivalent workflows containing real payment information.

Playwright trace artifacts may retain filled values through action logs, DOM snapshots, screenshots, or network payloads. Traces can also contain authentication headers, cookies, session identifiers, and other page data associated with the checkout session. The documented cleanup guidance addresses disk consumption but does not establish redaction, restrictive access, retention limits, or secure deletion requirements.

Attack Path

1. An Agent starts tracing an authenticated checkout workflow.
2. Real payment or account data is entered into the page.
3. Playwright records actions, snapshots, screenshots, and network details.
4. Trace resources containing sensitive values remain on disk.
5. The artifacts are retained, uploaded for debugging, included in support material, committed to source control, or exposed through permissive filesystem access.
6. An unauthorized party opens or parses the trace and recovers payment, authenticat ...[truncated 564 chars]

Remediation

View remediation

Remediation Suggestions

• Replace payment values with clearly labeled synthetic placeholders and state that real payment or authentication data must never be traced.
• Add a warning before tracing examples that diagnostic artifacts can contain form values, cookies, headers, DOM content, screenshots, and request or response bodies.
• Disable tracing for steps that handle secrets, payment data, recovery codes, or other regulated information.
• Redact sensitive fields, headers, cookies, and payloads before sharing or archiving traces.
• Write traces to a dedicated directory with restrictive user-only permissions.
• Apply short retention periods and securely delete trace files immediately after their debugging purpose is complete.
• Exclude trace directories and files from source control, build artifacts, telemetry, and automated uploads.
• Use isolated test accounts and synthetic payment credentials for all documented automation workflows.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (23)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The 'Delete Database' example issues indexedDB.deleteDatabase('myDatabase'), which is a destructive and potentially irreversible operation affecting stored application data. The documentation provides no immediate warning about data loss or the need to verify the target database before running it.

Content

No source excerpt is available for this finding.

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/storage-state.md (reported line 273)May include surrounding context.

md

- Never commit storage state files containing auth tokens
- Add `*.auth-state.json` to `.gitignore`
- Delete state files after automation completes
- Use environment variables for sensitive data
- By default, sessions run in-memory mode which is safer for sensitive operations

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The example demonstrates entering full payment-card data and CVV while tracing is enabled, even though the same document explains that traces capture screenshots, DOM snapshots, and network data. This normalizes recording highly sensitive financial data into trace artifacts, which could expose regulated payment information and create serious compliance and breach risks if the files are stored, transmitted, or reviewed by others.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The storage-state section documents saving, loading, listing, and modifying cookies, localStorage, and sessionStorage, all of which commonly contain authentication tokens and other secrets. Presenting these capabilities without any warning about handling credentials, persistence, or cross-session reuse increases the chance of accidental secret exposure or session hijacking.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

bash

playwright-cli route "**/*.jpg" --status=404
playwright-cli route "https://api.example.com/**" --body='{"mock": true}'
playwright-cli route-list
playwright-cli unroute "**/*.jpg"
playwright-cli unroute

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The raw-output examples include TOKEN=$(playwright-cli --raw cookie-get session_id), which directly demonstrates extraction of a session token into shell context. This is dangerous because it normalizes credential harvesting behavior and makes secret leakage via logs, shell history, process inspection, or follow-on commands much more likely.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The skill recommends npx playwright-cli without pinning a specific package version. This can cause non-deterministic installation of newer or compromised package versions at execution time, creating supply-chain risk in an agent context where commands may be run automatically.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The instruction to install @playwright/cli@latest or rely on unpinned npx playwright-cli introduces supply-chain exposure because the resolved code can change over time. In a skill definition, this is risky because users and agents may execute exactly what is documented, trusting the package source implicitly.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The documentation instructs users to run npx playwright without pinning an exact package version. npx may fetch the latest package version at execution time, which creates a supply-chain risk and harms reproducibility; if the upstream package or dependency tree is compromised, users could execute unexpected code.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

This example again relies on unpinned npx playwright, which can resolve to a different version over time or download code at run time. That exposes users to avoidable supply-chain risk and can also break tests unexpectedly due to version drift.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Using npx playwright test --debug=cli without version pinning is particularly risky in a debugging workflow because users may run it interactively and trust the resulting tooling session. If a malicious or unexpected version is fetched, it could execute arbitrary code in the developer environment under the guise of test debugging.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file includes examples that write files to disk via download.saveAs('./downloaded-file.pdf') and later persist authenticated browser state to auth.json. The surrounding documentation does not warn that these actions store potentially sensitive data locally, which could affect user privacy or system state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The clipboard examples show reading from and writing to the clipboard, which can expose or alter user data. The section lacks any user-facing warning that clipboard access may reveal sensitive information or overwrite existing clipboard contents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file includes delete-data commands that remove browser profile directories, which can erase cookies, storage, and other persisted session state. The surrounding documentation describes the command functionally but does not warn users that the operation is destructive and may be irreversible.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file documents commands that clear all cookies, which can log users out or remove persistent browser state, but the surrounding text does not warn about the impact before presenting the command. Under the markdown criteria for SQP-2, destructive behaviors that can affect user data or session integrity should be accompanied by an explicit warning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation presents a command to clear all localStorage items, which can remove saved application state and user data, but it does not include a user-facing warning in that section. The generic security notes at the end focus on secrets handling, not the destructive effect of clearing storage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This section documents sessionstorage-clear without any caution that it will erase in-session state such as temporary form progress or workflow state. For markdown skill documentation, destructive operations affecting user data or system state should be explicitly disclosed.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 77% confidence

Finding

Persisting browser state to disk can capture live session cookies, localStorage tokens, and other authentication artifacts that may be reused by anyone who obtains the file. In this skill context, the examples normalize saving reusable authenticated state, which increases the risk of credential/session leakage if files are stored insecurely, shared, or committed to version control.

Content

Scanner excerpt · references/storage-state.md (reported line 258)May include surrounding context.

md

playwright-cli open https://example.com
playwright-cli eval "() => { document.cookie = 'session=abc123'; localStorage.setItem('user', 'john'); }"

# Save state to file
playwright-cli state-save my-session.json

# ... later, in a new session ...

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation explicitly states that traces capture DOM snapshots, screenshots, network activity, console logs, headers, and bodies, all of which can contain credentials, session tokens, personal data, or other secrets. Presenting this capability without any privacy or data-handling warning can lead users to record and retain sensitive information unintentionally, increasing the risk of leakage through local files, sharing, or artifact storage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This guidance encourages recording browser sessions and sharing them for debugging or proof of work, but it does not warn that videos may capture passwords, session data, personal information, internal dashboards, or other sensitive on-screen content. In a browser automation skill, that omission is meaningful because users may record real environments and then store or distribute the resulting WebM files without applying redaction or access controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The markdown documents delete-data and later close-all/kill-all, which can remove browser data or terminate active browser processes. While the commands are named clearly, the documentation does not warn users that these actions may delete persistent session data or disrupt other ongoing browser work.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The file documents playwright-cli kill-all to forcefully kill daemon processes, which can disrupt active sessions and potentially lose unsaved browser state. Although the command purpose is mentioned, there is no user-facing warning about the abrupt and potentially disruptive nature of this action.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation explains how to persist browser profiles using --persistent and --profile, which changes session data from in-memory to on-disk storage. This affects privacy and data retention, but the markdown does not warn users that cookies, local storage, and related browsing data may remain on disk after use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.