스킬 playwright-browser-automation
📦

playwright-browser-automation

v4.0.0 콘텐츠 리비전 r1 높은 위험 ⚡ 스크립트 포함⚙️ 외부 명령어🌐 네트워크 접근🔑 환경 변수📁 파일 시스템 접근

Automatiza las pruebas de navegador con Playwright

Las comprobaciones manuales del navegador son lentas y es fácil pasar por alto problemas en formularios, enlaces y tamaños de pantalla. Esta skill ayuda a Claude, Codex y Claude Code a ejecutar automatización con Playwright, capturar capturas de pantalla y validar flujos web.

지원: Claude Codex Code(CC)
Maintain this Skill? Claim it ⚠️ 38 나쁨

이 스킬은 팩에 포함되어 있습니다

작업에 필요한 모든 스킬을 명령 하나로 설치하려면 전체 팩을 설치하세요.

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청
Review the Skillstore skill "playwright-browser-automation" from https://skillstore.io/skills/adammanuel-dev-playwright-browser-automation.md and its manifest at https://skillstore.io/api/skills/adammanuel-dev-playwright-browser-automation/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

테스트해 보기

"playwright-browser-automation" 사용 중입니다. Prueba la página de marketing en mi servidor de desarrollo local.

예상 결과:

  • Encontró un servidor de desarrollo local.
  • Abrió la página de marketing y capturó capturas de pantalla de escritorio y móvil.
  • Informó del título, los problemas de diseño visibles y cualquier enlace de navegación roto.

"playwright-browser-automation" 사용 중입니다. Comprueba si el inicio de sesión redirige al dashboard.

예상 결과:

  • Detectó varios servidores locales y preguntó cuál probar.
  • Ejecutó el flujo de inicio de sesión seleccionado con las credenciales de prueba proporcionadas.
  • Informó si aparecieron la URL del dashboard y los elementos de página esperados.

"playwright-browser-automation" 사용 중입니다. Haz una captura de pantalla de la página actual.

예상 결과:

La skill abrió la URL de destino en Playwright, capturó una captura de pantalla de página completa e informó dónde se guardó.

보안 감사

높은 위험
v9 • 2026. 7. 9. 버전별 보고서 열기

The skill is a legitimate Playwright browser automation helper, but it intentionally executes generated JavaScript locally and can install dependencies automatically. Most Markdown backtick, localhost URL, and schema UUID detections are false positives; the confirmed issues center on arbitrary code execution, external commands, weakened Chromium sandboxing, local port probing, and temporary file or screenshot handling.

4
스캔된 파일
1,533
분석된 줄 수
47
검토 항목
0
오탐 무시됨

확인된 보안 우려 사항 (5)

높음
UID/GID manipulation
args: ['--no-sandbox', '--disable-setuid-sandbox']
The browser launches with --no-sandbox and --disable-setuid-sandbox, which weakens Chromium isolation. This may be necessary in containers but increases impact if browser content is compromised.
높음
Screen capture upload
// Execution Screenshots - Captured screenshots during execution
The schema models captured execution screenshots and blob storage URLs, which can expose sensitive browser state if connected to runtime storage. The file alone does not upload data, so confidence is moderate.
높음
Arbitrary Local JavaScript Execution by Design
The skill directs the agent to generate Playwright scripts, pass inline code or files into run.js, and execute the resulting temporary JavaScript with require(tempFile). This is powerful browser automation, but it also executes local code with the user account privileges.
The documentation and executor implementation clearly describe and implement dynamic execution of caller-provided JavaScript. This is intentional but materially risky for marketplace auto-install use.
중간
Unrelated Credential and Screenshot Storage Schema Included
The package includes a Prisma schema for workflows, encrypted credentials, webhooks, screenshots, and blob URLs. This is broader than a local Playwright helper and may confuse reviewers about whether sensitive browser data or credentials are stored by the skill.
The schema contains explicit models for screenshots, encrypted credentials, and webhooks, while the skill description is local browser automation. No runtime link was found, so this is a packaging and scope concern rather than proven exfiltration.
낮음
System reconnaissance
hostname: 'localhost',
The localhost hostname is used during port probing to discover running dev servers. The scope is local, but it is still reconnaissance of local services.
기능 검토 항목 (47)

이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.

높음
Database connection strings
url = env("DATABASE_URL")
The Prisma schema references DATABASE_URL, which is a sensitive database connection string if this schema is used. The file is not executed by the skill path, so confidence is limited.
높음
Dynamic require with variable
require(tempFile);
run.js writes user-provided or agent-provided code to a temporary file and executes it with require(tempFile). This is arbitrary local JavaScript execution by design.
높음
Node.js child_process module
const { execSync } = require('child_process');
run.js imports child_process to install dependencies automatically. This enables local command execution from the skill runner.
높음
Synchronous process execution
execSync('npm install', { stdio: 'inherit', cwd: __dirname });
The executor runs npm install or npx playwright install chromium through execSync when Playwright is missing. Automatic package installation is a real supply-chain and command-execution risk.
높음
Synchronous process execution
execSync('npx playwright install chromium', { stdio: 'inherit', cwd: __dirname });
The executor runs npm install or npx playwright install chromium through execSync when Playwright is missing. Automatic package installation is a real supply-chain and command-execution risk.
중간
Ruby/shell backtick execution
return `
The template interpolates caller-provided code into an executable wrapper. This supports the skill purpose, but it means untrusted code can run locally if invoked carelessly.
중간
Ruby/shell backtick execution
return `
The template interpolates caller-provided code into an executable wrapper. This supports the skill purpose, but it means untrusted code can run locally if invoked carelessly.
중간
Node.js fs operations
return fs.readFileSync(filePath, 'utf8');
run.js accepts a caller-supplied file path and reads it if it exists. This is intended for scripts but can read arbitrary local files passed to the executor.
중간
Node.js fs operations
return fs.readFileSync(0, 'utf8');
run.js reads executable code from stdin. This is intended, but it enables arbitrary code execution through piped input.
중간
Node.js fs operations
fs.writeFileSync(tempFile, code, 'utf8');
run.js writes caller-provided code into a temporary JavaScript file inside the skill directory before executing it. This is a real executable file creation risk.
중간
Node.js fs stat operations
if (args.length > 0 && fs.existsSync(args[0])) {
run.js accepts a caller-supplied file path and reads it if it exists. This is intended for scripts but can read arbitrary local files passed to the executor.
중간
Synchronous file operations
return fs.readFileSync(filePath, 'utf8');
run.js accepts a caller-supplied file path and reads it if it exists. This is intended for scripts but can read arbitrary local files passed to the executor.
중간
Synchronous file operations
return fs.readFileSync(0, 'utf8');
run.js reads executable code from stdin. This is intended, but it enables arbitrary code execution through piped input.
중간
Synchronous file operations
fs.writeFileSync(tempFile, code, 'utf8');
run.js writes caller-provided code into a temporary JavaScript file inside the skill directory before executing it. This is a real executable file creation risk.
중간
Ruby/shell backtick execution
```bash
The skill documentation instructs the agent to run shell commands for setup, server detection, or Playwright execution. This is intended behavior, but it is still external command execution.
중간
Ruby/shell backtick execution
4. I execute it via: `cd $SKILL_DIR && node run.js /tmp/playwright-test-*.js`
The skill documentation instructs the agent to run shell commands for setup, server detection, or Playwright execution. This is intended behavior, but it is still external command execution.
중간
Ruby/shell backtick execution
```bash
The skill documentation instructs the agent to run shell commands for setup, server detection, or Playwright execution. This is intended behavior, but it is still external command execution.
중간
Ruby/shell backtick execution
```bash
The skill documentation instructs the agent to run shell commands for setup, server detection, or Playwright execution. This is intended behavior, but it is still external command execution.
중간
Ruby/shell backtick execution
```bash
The skill documentation instructs the agent to run shell commands for setup, server detection, or Playwright execution. This is intended behavior, but it is still external command execution.
중간
Ruby/shell backtick execution
```bash
The skill documentation instructs the agent to run shell commands for setup, server detection, or Playwright execution. This is intended behavior, but it is still external command execution.
중간
Ruby/shell backtick execution
```bash
The skill documentation instructs the agent to run shell commands for setup, server detection, or Playwright execution. This is intended behavior, but it is still external command execution.
중간
Temp directory access
2. **Write scripts to /tmp** - NEVER write test files to skill directory; always use `/tmp/playwrigh
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
중간
Temp directory access
3. I write custom Playwright code in `/tmp/playwright-test-*.js` (won't clutter your project)
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
중간
Temp directory access
4. I execute it via: `cd $SKILL_DIR && node run.js /tmp/playwright-test-*.js`
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
중간
Temp directory access
// /tmp/playwright-test-page.js
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
중간
Temp directory access
await page.screenshot({ path: '/tmp/screenshot.png', fullPage: true });
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
중간
Temp directory access
console.log('📸 Screenshot saved to /tmp/screenshot.png');
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
중간
Temp directory access
cd $SKILL_DIR && node run.js /tmp/playwright-test-page.js
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
중간
Temp directory access
// /tmp/playwright-test-responsive.js
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
중간
Temp directory access
await page.screenshot({ path: '/tmp/desktop.png', fullPage: true });
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
중간
Temp directory access
await page.screenshot({ path: '/tmp/mobile.png', fullPage: true });
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
중간
Temp directory access
// /tmp/playwright-test-login.js
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
중간
Temp directory access
// /tmp/playwright-test-form.js
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
중간
Temp directory access
path: '/tmp/screenshot.png',
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
중간
Temp directory access
console.log('📸 Screenshot saved to /tmp/screenshot.png');
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
중간
Temp directory access
// /tmp/playwright-test-responsive-full.js
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
중간
Temp directory access
path: `/tmp/${viewport.name.toLowerCase()}.png`,
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
중간
Temp directory access
await page.screenshot({ path: '/tmp/quick-screenshot.png', fullPage: true });
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
중간
Temp directory access
- **Use /tmp for test files** - Write to `/tmp/playwright-test-*.js`, never to skill directory or us
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
중간
Temp directory access
[Writes custom automation script to /tmp/playwright-test-marketing.js with URL parameterized]
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
중간
Temp directory access
[Runs: cd $SKILL_DIR && node run.js /tmp/playwright-test-marketing.js]
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
중간
Temp directory access
[Shows results with screenshots from /tmp/]
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
중간
Temp directory access
[Writes login automation to /tmp/playwright-test-login.js]
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
중간
Temp directory access
[Runs: cd $SKILL_DIR && node run.js /tmp/playwright-test-login.js]
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
낮음
HTTP/HTTPS request
const req = http.request({
The helper sends HTTP HEAD requests to localhost ports to discover development servers. This is local-only and purposeful, but it is still network probing behavior.
낮음
HTTP client library
const req = http.request({
The helper sends HTTP HEAD requests to localhost ports to discover development servers. This is local-only and purposeful, but it is still network probing behavior.
낮음
Hardcoded URL
detectedServers.push(`http://localhost:${port}`);
The helper sends HTTP HEAD requests to localhost ports to discover development servers. This is local-only and purposeful, but it is still network probing behavior.

위험 요인

⚡ 스크립트 포함 (3)
⚙️ 외부 명령어 (50)
🌐 네트워크 접근 (14)
🔑 환경 변수 (6)
📁 파일 시스템 접근 (38)

감지된 패턴

UID/GID manipulationSystem reconnaissanceScreen capture upload
감사자: claude 감사 이력 보기 →
이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기
보안 평가

보고서 링크 복사

https://skillstore.io/skills/adammanuel-dev-playwright-browser-automation/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/adammanuel-dev-playwright-browser-automation/security.svg)](https://skillstore.io/skills/adammanuel-dev-playwright-browser-automation?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/adammanuel-dev-playwright-browser-automation?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/adammanuel-dev-playwright-browser-automation/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/adammanuel-dev-playwright-browser-automation.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
학술 인용 (APA · BibTeX · CFF)

APA 인용

Claude Assistant. (2026). playwright-browser-automation security audit report (audit version 9) [Author version 4.0.0]. Skillstore. https://skillstore.io/skills/adammanuel-dev-playwright-browser-automation/audits/9

BibTeX 인용

@techreport{claude-assistant-adammanuel-dev-playwright-browser-automation-2026, author = {Claude Assistant}, title = {playwright-browser-automation security audit report (audit version 9)}, institution = {Skillstore}, year = {2026}, number = {9}, url = {https://skillstore.io/skills/adammanuel-dev-playwright-browser-automation/audits/9}, note = {Author version 4.0.0} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "playwright-browser-automation security audit report (audit version 9)" version: "4.0.0" type: report authors: - name: "Claude Assistant" date-released: "2026-07-09" url: "https://skillstore.io/skills/adammanuel-dev-playwright-browser-automation/audits/9" identifiers: - type: other value: "skillstore:adammanuel-dev-playwright-browser-automation:audit:9" description: "Skillstore immutable audit report identifier"

변형 비교

설치 가능한 변형 2개

각 작성자의 스킬은 별도의 설치 항목으로 유지됩니다. 추천 변형은 Skillstore 근거로 순위가 정해집니다.

이 변형이 1위인 이유

Skillstore 사용량이 더 높음
Claude Assistant 권장 현재

adammanuel-dev-playwright-browser-automation

Skillstore 점수 38
증거 신뢰도 중간
Skillstore 사용량 56
업데이트됨

2026-10-21

dataflightsolutions-playwright-browser-automation

Skillstore 점수 38
증거 신뢰도 중간
Skillstore 사용량 43
업데이트됨

2026-09-09

Skillstore 점수

이 점수의 이유 증거 신뢰도: 중간
55
아키텍처
100
유지보수성
87
콘텐츠
70
커뮤니티
91
사양 준수

만들 수 있는 것

Comprobar una funcionalidad local antes del commit

Ejecuta un navegador a través de un servidor de desarrollo local y verifica que la ruta principal del usuario funcione.

Validar diseños responsive

Abre una página en tamaños de escritorio, tablet y móvil, y captura capturas de pantalla para revisión.

Probar flujos web comunes

Rellena formularios, envía pantallas de inicio de sesión, sigue enlaces e informa de fallos visibles.

이 프롬프트를 사용해 보세요

Probar una página local
Usa la skill de automatización de navegador con Playwright para encontrar mi servidor de desarrollo local y abrir la página de inicio. Informa del título de la página y de cualquier error visible en la consola.
Capturar capturas de pantalla responsive
Usa Playwright para probar la página actual en anchos de escritorio, tablet y móvil. Guarda capturas de pantalla y resume los problemas de diseño que observes.
Verificar un flujo de formulario
Usa Playwright para abrir el formulario de contacto, rellenarlo con valores de prueba realistas, enviarlo y confirmar si aparece un mensaje de éxito.
Auditar un recorrido de usuario completo
Usa Playwright para probar el recorrido de inicio de sesión, la carga del dashboard, los enlaces de navegación y el comportamiento responsive. Pregunta antes de usar credenciales o ejecutar scripts generados.

모범 사례

  • Revisa los scripts de Playwright generados antes de ejecutarlos, especialmente cuando usen credenciales.
  • Usa cuentas locales o de prueba y evita datos de producción durante la automatización del navegador.
  • Limpia las capturas de pantalla y los archivos temporales después de que el resultado ya no sea necesario.

피하기

  • No ejecutes scripts generados contra sitios de producción sin autorización.
  • No pegues contraseñas reales, tokens ni datos de pago en prompts de pruebas automatizadas.
  • No trates las capturas de pantalla como inofensivas si la página puede mostrar datos privados.

자주 묻는 질문

¿Esta skill ejecuta acciones reales en el navegador?
Sí. Usa Playwright para iniciar un navegador, navegar por páginas, interactuar con elementos y capturar capturas de pantalla.
¿Puede encontrar mi servidor de desarrollo local?
Sí. Comprueba puertos localhost comunes y pregunta qué servidor usar si encuentra más de uno.
¿Es compatible con Claude Code?
Sí. El informe enumera Claude, Codex y Claude Code como herramientas compatibles.
¿Es seguro usarla con credenciales?
Usa credenciales de prueba cuando sea posible. Los scripts generados y las capturas de pantalla pueden exponer datos sensibles si se manejan de forma descuidada.
¿Dónde se almacenan los scripts generados?
La documentación de la skill indica escribir scripts en /tmp y el ejecutor crea archivos temporales en el directorio de la skill.
¿Puede probar sitios web externos?
Sí, cuando proporcionas una URL autorizada. No debes usarla en sitios donde no tengas permiso para automatizar el acceso.

개발자 세부 정보

라이선스

MIT

작성자 버전

v4.0.0

Skillstore 리비전

r1

참조

7db9b9f06e0ab79c575b58bc48c4d8dc9849f424

유지보수 최신성

2026. 7. 21.

사용량

9 다운로드 · 217 조회

파일 구조

📁 lib/

📄 helpers.js

📁 prisma/

📄 schema.prisma

📄 run.js

📄 SKILL.md

Claude Assistant의 다른 스킬

전체 보기