Security checks for vulnerabilities and agentic risk
Overview
This skill is legitimate browser automation guidance, but it enables powerful browser control with persistent login state, network exposure options, and mutable package execution that users should review carefully.
Install only if you are comfortable giving the MCP server control of a browser that may hold active sessions. Pin package versions, avoid sudo npx, keep the server bound to localhost unless protected by strong network controls, use task-specific isolated profiles where possible, and require explicit user confirmation before purchases, account changes, downloads of private data, or use of MFA/secrets.
The skill is designed to interact with real authenticated websites and even mentions checkout, downloading statements, and dashboards, but it does not include a clear warning that actions may have real-world consequences. In an agent context, lack of an explicit authorization and confirmation boundary increases the chance of unintended transactions, privacy violations, or destructive account actions.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding
The skill instructs users to run an unpinned package via npx, which pulls whatever version is current at execution time. That creates a supply-chain risk: a compromised upstream release or dependency could execute arbitrary code on the host during installation or runtime, and this skill is explicitly for browser automation on authenticated sites, increasing the sensitivity of the environment.
Content
No source excerpt is available for this finding.
Sudo/Root Execution
Medium
Category
Privilege Escalation
Confidence
90% confidence
Finding
The document recommends running a command with sudo, which increases the blast radius if the invoked tooling or its supply chain is compromised. Even though the stated goal is legitimate dependency installation, pairing privileged execution with network-fetched Node tooling is risky because it can lead to full host compromise rather than a user-scoped browser issue.
Content
Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.
bash
npx playwright install chromium
# Linux only: installs missing libraries (x11, fonts, etc.)
sudo npx playwright install-deps chromium
```
2. **Launch the MCP server**
- Fast path: run `scripts/start_playwright_mcp.sh` from this skill directory. Override with `PWMCP_BROWSER`, `PWMCP_PORT`, etc.
Rp1
Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding
This is another unpinned npx execution path, again allowing code from the latest upstream package set to run on the machine without version control. Because the command is run with elevated privileges on Linux in nearby guidance, compromise here could have severe host impact beyond the browser session.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The documentation uses npx playwright install chromium without pinning a package version, which can pull whatever version is current at execution time. That creates a supply-chain and reproducibility risk: future installs may execute changed code unexpectedly, and a compromised upstream package or dependency could affect hosts following the instructions.
Content
No source excerpt is available for this finding.
Sudo/Root Execution
Medium
Category
Privilege Escalation
Confidence
86% confidence
Finding
The documentation instructs users to run sudo npx ..., which executes package-fetched code with root privileges. Even though the stated purpose is installing browser dependencies, doing so through npx amplifies the impact of any compromised package, typo-squat, or unexpected install behavior.
Content
Scanner excerpt · references/setup.md (reported line 10)May include surrounding context.
(Or use npx playwright install --with-deps to fetch all engines.)
Client: Any MCP-compatible agent (OpenClaw, Claude Code, Cursor, etc.).
Rp1
Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding
sudo npx playwright install-deps chromium combines unpinned package execution with elevated privileges, increasing the blast radius if the fetched package or its dependency chain is malicious or tampered with. Even absent compromise, it makes builds non-reproducible and can execute unexpected install logic as root.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding
The alternative recommendation npx playwright install --with-deps is also unpinned, so users may execute different code over time with no review checkpoint. In automation/server setup documentation, that is a meaningful supply-chain risk because operators often run these commands verbatim.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding
npx @playwright/mcp@latest explicitly opts into the latest published version, which is effectively unpinned execution. Because this launches an MCP server that can control a browser and interact with authenticated sessions, executing an unexpected upstream release materially increases risk.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding
The documentation recommends persistent browser profiles and notes they keep login state, cookies, and local storage, but it does not clearly warn about the security consequences of retaining authenticated sessions and sensitive data on disk. In an agent-driven browser automation skill, this increases the chance of credential leakage, session hijacking, or unintended cross-task data exposure.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding
The persistent-profile launch command again uses @latest, so every invocation may run newly published code with access to retained cookies and browser state. In this context, the combination of unpinned package execution and persisted authentication artifacts makes the risk more serious than a generic example command.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding
The isolated-session template still launches @playwright/mcp@latest, preserving the same supply-chain risk despite the safer browser isolation model. A compromised or unexpected package version could still access provided storage state or browser content during execution.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding
The remote HTTP exposure section explains how to bind the MCP server to 0.0.0.0 and only briefly says to secure the port with a firewall or tunnel, without clearly stating that this can expose full browser control and potentially authenticated session data over the network. In this skill context, remote browser control can enable account takeover, data exfiltration, and abuse of logged-in sessions if access is broad or unencrypted.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding
The remote/HTTP transport example uses @latest, which is especially risky because it exposes browser automation over a network-facing service. If an upstream change introduces insecure defaults or malicious behavior, operators may deploy it directly on reachable infrastructure.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding
The reference config file includes @playwright/mcp@latest, encouraging long-lived configurations that silently drift to new code. Configuration snippets are often copied into production, so this can create persistent supply-chain exposure with little visibility.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding
The launcher forwards ${EXTRA} and "$@" directly into the npx command, allowing user-controlled flags to alter server behavior without any validation or confirmation. In this context that is particularly dangerous because the server controls a real browser session; an attacker or unsafe caller could enable broader network access, change profile paths, weaken protections, or inject additional runtime options that expose credentials, cookies, or internal resources.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding
The script invokes npx @playwright/mcp@latest, which fetches and executes the latest package version at runtime instead of a pinned, reviewed release. This creates a supply-chain risk: any malicious or compromised upstream release would be executed immediately in a tool specifically designed to browse authenticated sites and access sensitive session data.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
82% confidence
Finding
The guidance discusses providing MFA codes and 2FA tokens operationally, but does not state that these should only be used with explicit user authorization for a specific session or action. In a browser automation skill targeting authenticated services, this can normalize handling highly sensitive authentication factors without adequate consent controls.
