Audit-Verlauf

scripts/with_server.py:88

Prompt Injection Attempt Detected

The instruction says, "DO NOT read the source until you try running the script first" and later recommends using scripts as black boxes. This discourages security inspection before executing community code.

The text explicitly directs the agent to execute code before inspection and to avoid reading the implementation. That behavior can conceal unsafe operations from review.

Elemente der Fähigkeitsprüfung (5)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Hoch

Python subprocess.run

result = subprocess.run(args.command)

The helper executes the unrestricted trailing command supplied through command-line arguments. Shell parsing is disabled here, but the caller can still select any available executable and arguments.

Hoch

examples/console_logging.py:31

Python subprocess.Popen

process = subprocess.Popen(

The helper passes each caller-provided server string to subprocess.Popen with shell=True. Shell operators in that string can execute arbitrary local commands with the agent process permissions.

Mittel

Python file write/append

with open('/mnt/user-data/outputs/console.log', 'w') as f:

The example persists page-controlled console messages to a fixed file and overwrites any existing file there. Console output can contain credentials or other sensitive application data.

Mittel

examples/element_discovery.py:37

Temp directory access

page.screenshot(path='/tmp/page_discovery.png', full_page=True)

The example writes a potentially sensitive full-page screenshot to a predictable shared temporary path. This can overwrite an existing file or expose page content to other local processes.

Mittel

SKILL.md:69

Temp directory access

page.screenshot(path='/tmp/inspect.png', full_page=True)

The recommended code writes a full-page screenshot to a predictable path in a shared temporary directory. Sensitive page content may be overwritten or exposed through that path.

Risikofaktoren

Geprüft von: codex

Audit-Version 11

2026年7月17日 10:23

The Playwright examples use local URLs and fixed output paths, so the related static findings are benign. The server helper executes caller-provided server strings with shell=True, and the documentation discourages reviewing that helper before execution. These issues require review before automated installation or use with untrusted commands.

6

Gescannte Dateien

512

Analysierte Zeilen

5

Prüfelemente

0

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (1)

Mittel

Guidance Discourages Source Review Before Execution

The documentation directs users to run bundled scripts as black boxes and not read their source first. This reduces informed review of a helper that executes shell commands.

The instructions explicitly discourage source inspection and recommend black-box execution. The helper contains a confirmed shell-enabled subprocess call.

Elemente der Fähigkeitsprüfung (1)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Hoch

Python subprocess.Popen

process = subprocess.Popen(

The helper passes the user-supplied --server string to subprocess.Popen with shell=True. Any caller-controlled shell syntax executes with the current user privileges.

Risikofaktoren

Geprüft von: claude

Audit-Version 10

2026年7月17日 10:23

The Playwright examples use local URLs and fixed output paths, so the related static findings are benign. The server helper executes caller-provided server strings with shell=True, and the documentation discourages reviewing that helper before execution. These issues require review before automated installation or use with untrusted commands.

6

Gescannte Dateien

512

Analysierte Zeilen

5

Prüfelemente

0

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (1)

Mittel

Guidance Discourages Source Review Before Execution

The documentation directs users to run bundled scripts as black boxes and not read their source first. This reduces informed review of a helper that executes shell commands.

The instructions explicitly discourage source inspection and recommend black-box execution. The helper contains a confirmed shell-enabled subprocess call.

Elemente der Fähigkeitsprüfung (1)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Hoch

Python subprocess.Popen

process = subprocess.Popen(

The helper passes the user-supplied --server string to subprocess.Popen with shell=True. Any caller-controlled shell syntax executes with the current user privileges.

Risikofaktoren

Geprüft von: claude

Audit-Version 9

2026年7月17日 10:23

The Playwright examples use local URLs and fixed output paths, so the related static findings are benign. The server helper executes caller-provided server strings with shell=True, and the documentation discourages reviewing that helper before execution. These issues require review before automated installation or use with untrusted commands.

6

Gescannte Dateien

512

Analysierte Zeilen

5

Prüfelemente

0

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (1)

Mittel

Guidance Discourages Source Review Before Execution

The documentation directs users to run bundled scripts as black boxes and not read their source first. This reduces informed review of a helper that executes shell commands.

The instructions explicitly discourage source inspection and recommend black-box execution. The helper contains a confirmed shell-enabled subprocess call.

Elemente der Fähigkeitsprüfung (1)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Hoch

Python subprocess.Popen

process = subprocess.Popen(

The helper passes the user-supplied --server string to subprocess.Popen with shell=True. Any caller-controlled shell syntax executes with the current user privileges.

Risikofaktoren

Geprüft von: claude

Audit-Version 8

2026年7月5日 04:42

Most markdown backtick and localhost findings are false positives because they are local Playwright examples. The real risks are command execution in scripts/with_server.py and instructions that discourage source review before execution. The author should remove black-box execution guidance and harden process launching.

6

Gescannte Dateien

512

Analysierte Zeilen

6

Prüfelemente

0

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (1)

Hoch

scripts/with_server.py:88

Prompt Injection Attempt Detected

SKILL.md tells agents to 'DO NOT read the source' before running scripts and recommends using bundled scripts as black boxes. This can suppress source review and encourage execution of untrusted helper code.

The wording directly instructs the agent to avoid source review before execution. It may be intended for context management, but it matches prompt-injection behavior.

Elemente der Fähigkeitsprüfung (2)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Hoch

Python subprocess.run

result = subprocess.run(args.command)

The helper executes the command supplied after the server arguments. It avoids shell=True here, but still runs arbitrary local processes from the skill workflow.

Hoch

Python subprocess.Popen

process = subprocess.Popen(

The helper passes the user-supplied --server value to subprocess.Popen with shell=True. Untrusted server commands can execute arbitrary shell syntax.

Risikofaktoren

Geprüft von: codex

Audit-Version 7

2026年7月5日 04:42

Most markdown backtick and localhost findings are false positives because they are local Playwright examples. The real risks are command execution in scripts/with_server.py and instructions that discourage source review before execution. The author should remove black-box execution guidance and harden process launching.

6

Gescannte Dateien

512

Analysierte Zeilen

6

Prüfelemente

0

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (1)

Hoch

scripts/with_server.py:88

Prompt Injection Attempt Detected

SKILL.md tells agents to 'DO NOT read the source' before running scripts and recommends using bundled scripts as black boxes. This can suppress source review and encourage execution of untrusted helper code.

The wording directly instructs the agent to avoid source review before execution. It may be intended for context management, but it matches prompt-injection behavior.

Elemente der Fähigkeitsprüfung (2)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Hoch

Python subprocess.run

result = subprocess.run(args.command)

The helper executes the command supplied after the server arguments. It avoids shell=True here, but still runs arbitrary local processes from the skill workflow.

Hoch

scripts/with_server.py:37-40 scripts/with_server.py:68-74 SKILL.md:40-49

Python subprocess.Popen

process = subprocess.Popen(

The helper passes the user-supplied --server value to subprocess.Popen with shell=True. Untrusted server commands can execute arbitrary shell syntax.

Risikofaktoren

Geprüft von: codex

Audit-Version 6

2026年6月28日 12:49

Static analysis flagged many command, network, filesystem, and weak-crypto patterns. Most weak-crypto and hardcoded URL findings are false positives from license text or localhost examples, but the helper script intentionally runs user-supplied server commands with shell=True. This appears legitimate for local webapp testing, so publication is acceptable with a clear command-execution warning.

6

Gescannte Dateien

512

Analysierte Zeilen

8

Prüfelemente

1

Falschmeldungen ignoriert

Elemente der Fähigkeitsprüfung (5)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Mittel

User-Supplied Server Commands Run Through Shell

The helper accepts --server values and starts them with subprocess.Popen using shell=True. This is useful for commands such as cd and npm run dev, but any untrusted server string could execute arbitrary shell syntax.

The shell=True call is confirmed and its input comes from command-line arguments. The context is a local testing helper, so this is a real but expected command-execution risk rather than evidence of malware.

Mittel

scripts/with_server.py:40 scripts/with_server.py:86-89

Arbitrary Follow-Up Command Execution

After servers are ready, the helper runs the remaining command arguments with subprocess.run. This behavior is explicit and needed for automation, but users should run only commands they trust.

The command execution is direct and confirmed, but subprocess.run receives an argument list without shell=True. Risk depends on what the user chooses to execute.

Niedrig

examples/console_logging.py:5 examples/element_discovery.py:10 SKILL.md:59 LICENSE.txt:4 LICENSE.txt:196

Localhost Network Examples

Hardcoded URLs point to localhost web applications or Apache license pages. No evidence found of data exfiltration or calls to suspicious external services.

The cited application URLs use localhost, and the external URLs are standard Apache license references. This strongly supports a false-positive network finding.

Niedrig

examples/console_logging.py:31-32 examples/element_discovery.py:37-38 SKILL.md:69

Expected Screenshot and Log File Writes

Example scripts write screenshots and console logs to output or temporary paths. These writes are expected artifacts for browser testing and do not target sensitive files.

The file paths are used for logs and screenshots generated by browser automation. There is no evidence of sensitive file reads, persistence, or hidden writes.

Niedrig

SKILL.md:24-27 SKILL.md:37-49 SKILL.md:83-89

Shell Command Examples in Documentation

The skill documentation shows users how to run local test servers and Playwright scripts. These are operational examples, but users should avoid copying commands from untrusted projects.

The documentation clearly intends local development automation. It still encourages command execution, so the residual risk is real but lower than hidden execution in code.

Statische falsch positive Treffer ignoriert (1)

Diese statischen Treffer wurden durch semantische Prüfung verworfen oder entsprachen reinen Schema-Tokens; daher werden sie aus Transparenzgründen angezeigt, beeinflussen jedoch nicht die Qualitätsbewertung.

Niedrig

SKILL.md:3 SKILL.md:88 LICENSE.txt:61 LICENSE.txt:107 LICENSE.txt:141-146 LICENSE.txt:186

Weak-Crypto Matches Are Textual False Positives

Static analysis flagged weak cryptographic algorithm patterns in markdown and license text. No cryptographic API use or hashing implementation was found at those locations.

The cited lines are natural-language documentation or license prose, not code. This makes the weak-crypto alerts very likely false positives.

Risikofaktoren

🌐 Netzwerkzugriff (5)

examples/console_logging.py:5 examples/element_discovery.py:10 LICENSE.txt:4 LICENSE.txt:196 SKILL.md:59

📁 Dateisystemzugriff (4)

examples/console_logging.py:31 examples/element_discovery.py:37 examples/element_discovery.py:38 SKILL.md:69

⚙️ Externe Befehle (4)

scripts/with_server.py:69-74 scripts/with_server.py:88 SKILL.md:40-49 SKILL.md:85

Erkannte Muster

subprocess.Popen With shell=TrueBrowser Automation Writes Local Artifacts

Geprüft von: codex

Audit-Version 5

2026年1月16日 19:24

This is a legitimate Playwright-based web testing toolkit. All 67 static findings are false positives: hardcoded URLs point to localhost for testing or standard Apache license URLs, subprocess commands require user-provided input and align with server management purpose, and the 'weak cryptographic algorithm' detections are false matches on Apache license text containing the word 'license'. No credential theft, data exfiltration, or malicious behavior detected.

7

Gescannte Dateien

776

Analysierte Zeilen

2

Prüfelemente

0

Falschmeldungen ignoriert

Risikofaktoren

⚡ Enthält Skripte (1)

scripts/with_server.py:69-74 scripts/with_server.py:88

⚙️ Externe Befehle (2)

Geprüft von: claude

Audit-Version 4

2026年1月16日 19:24

This is a legitimate Playwright-based web testing toolkit. All 67 static findings are false positives: hardcoded URLs point to localhost for testing or standard Apache license URLs, subprocess commands require user-provided input and align with server management purpose, and the 'weak cryptographic algorithm' detections are false matches on Apache license text containing the word 'license'. No credential theft, data exfiltration, or malicious behavior detected.

7

Gescannte Dateien

776

Analysierte Zeilen

2

Prüfelemente

0

Falschmeldungen ignoriert

Risikofaktoren

⚡ Enthält Skripte (1)

scripts/with_server.py:69-74 scripts/with_server.py:88

⚙️ Externe Befehle (2)

Geprüft von: claude

Audit-Version 3

2026年1月10日 11:26

This skill uses Playwright for browser automation and includes a server management script that executes subprocess commands. The capabilities align with its stated purpose of web application testing. No evidence of credential theft, data exfiltration, or malicious network behavior. The shell=True subprocess pattern is standard for server management workflows.

6

Gescannte Dateien

511

Analysierte Zeilen

3

Prüfelemente

0

Falschmeldungen ignoriert

Elemente der Fähigkeitsprüfung (1)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Mittel

scripts/with_server.py:69-74 scripts/with_server.py:88

Subprocess execution with shell=True

The with_server.py script uses subprocess.Popen with shell=True to execute server commands and user-provided commands. While this is necessary for the script's purpose (managing server lifecycle), shell=True can be a security concern if untrusted input is passed. The script accepts arbitrary commands via --server and command-line arguments, which are then executed on the user's system. Relevant code at scripts/with_server.py:69-74: ```python process = subprocess.Popen( server['cmd'], shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE ) ``` And at line 88: ```python result = subprocess.run(args.command) ``` An attacker who could influence the server commands or the command to run could potentially execute arbitrary code. Users should only run this script with trusted commands.

Risikofaktoren

⚡ Enthält Skripte (1)

scripts/with_server.py:69-74 scripts/with_server.py:88

⚙️ Externe Befehle (2)

Geprüft von: claude

Audit-Version 2

2026年1月10日 11:26

This skill uses Playwright for browser automation and includes a server management script that executes subprocess commands. The capabilities align with its stated purpose of web application testing. No evidence of credential theft, data exfiltration, or malicious network behavior. The shell=True subprocess pattern is standard for server management workflows.

6

Gescannte Dateien

511

Analysierte Zeilen

3

Prüfelemente

0

Falschmeldungen ignoriert

Elemente der Fähigkeitsprüfung (1)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Mittel

scripts/with_server.py:69-74 scripts/with_server.py:88

Subprocess execution with shell=True

The with_server.py script uses subprocess.Popen with shell=True to execute server commands and user-provided commands. While this is necessary for the script's purpose (managing server lifecycle), shell=True can be a security concern if untrusted input is passed. The script accepts arbitrary commands via --server and command-line arguments, which are then executed on the user's system. Relevant code at scripts/with_server.py:69-74: ```python process = subprocess.Popen( server['cmd'], shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE ) ``` And at line 88: ```python result = subprocess.run(args.command) ``` An attacker who could influence the server commands or the command to run could potentially execute arbitrary code. Users should only run this script with trusted commands.

Risikofaktoren

⚡ Enthält Skripte (1)

scripts/with_server.py:69-74 scripts/with_server.py:88

⚙️ Externe Befehle (2)

Geprüft von: claude

Audit-Version 1

2026年1月10日 11:26

This skill uses Playwright for browser automation and includes a server management script that executes subprocess commands. The capabilities align with its stated purpose of web application testing. No evidence of credential theft, data exfiltration, or malicious network behavior. The shell=True subprocess pattern is standard for server management workflows.

6

Gescannte Dateien

511

Analysierte Zeilen

3

Prüfelemente

0

Falschmeldungen ignoriert

Elemente der Fähigkeitsprüfung (1)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Mittel

scripts/with_server.py:69-74 scripts/with_server.py:88

Subprocess execution with shell=True

The with_server.py script uses subprocess.Popen with shell=True to execute server commands and user-provided commands. While this is necessary for the script's purpose (managing server lifecycle), shell=True can be a security concern if untrusted input is passed. The script accepts arbitrary commands via --server and command-line arguments, which are then executed on the user's system. Relevant code at scripts/with_server.py:69-74: ```python process = subprocess.Popen( server['cmd'], shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE ) ``` And at line 88: ```python result = subprocess.run(args.command) ``` An attacker who could influence the server commands or the command to run could potentially execute arbitrary code. Users should only run this script with trusted commands.

Risikofaktoren

⚡ Enthält Skripte (1)