スキル playwright-stealth-verify
📦
playwright-stealth-verify
コンテンツリビジョン r1 中リスク ⚙️ 外部コマンド🌐 ネットワークアクセス
Verify Automated Browser Fingerprints
Automated browsers can expose inconsistent fingerprints that weaken test reliability. This skill measures those inconsistencies with liarjs and explains the failing checks.
対応: Claude Codex Code(CC)
自分のエージェントでインストール
このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。
エージェントリクエスト
Review the Skillstore skill "playwright-stealth-verify" from https://skillstore.io/skills/liarjsdev-playwright-stealth-verify.md and its manifest at https://skillstore.io/api/skills/liarjsdev-playwright-stealth-verify/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。
エージェントが読めるリソース
AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。
テストする
「playwright-stealth-verify」を使用しています。 Check this Playwright Page offline and explain the result.
期待される結果:
- Overall result: weak fingerprint consistency.
- The webdriver and headless user-agent checks failed.
- No external network request was made.
- Review launch settings before setting a test threshold.
「playwright-stealth-verify」を使用しています。 Review the browser on my confirmed local CDP endpoint.
期待される結果:
The browser is reachable and the client signals are mostly coherent. Worker identity differs from the main thread, indicating a partial override.
「playwright-stealth-verify」を使用しています。 Suggest a continuous integration assertion from this stable baseline.
期待される結果:
Require a score of at least 85 and fail when webdriver, native integrity, or worker consistency reports a bad status.
セキュリティ監査
中リスクv1 • 2026/8/8 バージョン別レポートを開く
Most static findings confuse Markdown backticks with shell execution or flag documentation as reconnaissance. Four findings are confirmed because the skill runs external packages or sends fingerprint data to liarjs.dev. Contextual review also identified CDP session access and browser detection-evasion assessment as dual-use risks.
1
スキャンされたファイル
103
解析済み行数
5
レビュー項目
0
誤検知を無視
確認済みのセキュリティ上の懸念 (2)
中
Active Browser Session Attachment
The workflow attaches through CDP to a running browser. A mistaken endpoint can expose authenticated pages, cookies, and session data to executed tooling.
The instructions explicitly launch or attach to a CDP endpoint and acknowledge that the session belongs to the user.
中
Browser Detection-Evasion Assessment
The skill measures whether automation resembles a normal browser and evaluates stealth-plugin effects. Results can help tune automation against detection controls.
The stated purpose and result guidance directly assess automation indicators, although the document provides measurements rather than evasions.
機能レビュー項目 (5)
これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。
中
Ruby/shell backtick execution
```bash
The fenced block instructs npm to install a community package. Installation changes the project and can execute package lifecycle scripts.
中
Ruby/shell backtick execution
```bash
The Bash example uses npx to download and execute liarjs while attaching to a CDP endpoint. This is real external command execution.
中
Ruby/shell backtick execution
```bash
The Bash block launches Chrome with remote debugging and executes liarjs through npx. Both commands affect local processes and browser state.
中
Ruby/shell backtick execution
default (`npx liarjs@0.3`, which launches its own throwaway profile in a temp directory and deletes
The prose recommends running npx liarjs, which downloads and executes an external package. User confirmation reduces but does not remove this risk.
中
Hardcoded URL
- Without `--offline`, the browser under test fetches `https://liarjs.dev/api/net.json` to learn wha
Online mode sends a request to liarjs.dev that reveals IP, ASN, TLS, headers, and ClientHello attributes. This discloses fingerprint data externally.
リスク要因
⚙️ 外部コマンド (32)
SKILL.md:10 SKILL.md:19 SKILL.md:20 SKILL.md:23-33 SKILL.md:33-35 SKILL.md:35 SKILL.md:36 SKILL.md:40-42 SKILL.md:42-46 SKILL.md:46-48 SKILL.md:48-53 SKILL.md:53-56 SKILL.md:56-59 SKILL.md:59-67 SKILL.md:67 SKILL.md:68 SKILL.md:69 SKILL.md:70-71 SKILL.md:71 SKILL.md:72-73 SKILL.md:73 SKILL.md:74-76 SKILL.md:76 SKILL.md:79 SKILL.md:83-85 SKILL.md:85 SKILL.md:87-90 SKILL.md:90 SKILL.md:97-98 SKILL.md:98 SKILL.md:99-100 SKILL.md:100
🌐 ネットワークアクセス (6)
監査者: codex
このレポートを共有・引用
バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。
レポートリンクをコピー
https://skillstore.io/skills/liarjsdev-playwright-stealth-verify/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdownバッジ
[](https://skillstore.io/skills/liarjsdev-playwright-stealth-verify?utm_source=security_passport_badge)HTMLバッジ
<a href="https://skillstore.io/skills/liarjsdev-playwright-stealth-verify?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/liarjsdev-playwright-stealth-verify/security.svg" alt="Skillstore security assessment" loading="lazy"></a>埋め込みカード
<iframe src="https://skillstore.io/embed/skills/liarjsdev-playwright-stealth-verify.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学術引用 (APA · BibTeX · CFF)
APA形式の引用
liarjsdev. (2026). playwright-stealth-verify security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/liarjsdev-playwright-stealth-verify/audits/1BibTeX形式の引用
@techreport{liarjsdev-liarjsdev-playwright-stealth-verify-2026,
author = {liarjsdev},
title = {playwright-stealth-verify security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/liarjsdev-playwright-stealth-verify/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "playwright-stealth-verify security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "liarjsdev"
date-released: "2026-08-08"
url: "https://skillstore.io/skills/liarjsdev-playwright-stealth-verify/audits/1"
identifiers:
- type: other
value: "skillstore:liarjsdev-playwright-stealth-verify:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore スコア
このスコアの理由 証拠の信頼度: 中 55
アーキテクチャ
85
保守性
87
コンテンツ
65
コミュニティ
83
仕様準拠
作成できるもの
Validate Test Browser Configuration
Measure fingerprint consistency before automated browser tests run in continuous integration.
Audit a Custom Chromium Build
Attach to a local CDP endpoint and identify inconsistent browser identity signals.
Review Automation Fingerprint Regressions
Compare failed check identifiers after launch flags, plugins, or proxies change.
これらのプロンプトを試す
Run an Offline Check
Check my Playwright browser fingerprint offline. Explain the score and list the failed checks without changing the browser.
Inspect an Existing Page
Use liarjs checkPage with my existing Page object. Summarize fingerprint inconsistencies and suggest test assertions.
Audit a Local CDP Browser
After I confirm ownership, audit the browser at my local CDP endpoint. Do not visit third-party pages or modify the profile.
Design a Regression Gate
Analyze my baseline and current fingerprint results. Propose score and check-level gates that detect meaningful regressions while limiting false failures.
ベストプラクティス
- Use offline mode when external network observation is unnecessary.
- Confirm CDP endpoint ownership and use an isolated browser profile.
- Pin liarjs to an exact reviewed version in the project lockfile.
回避
- Do not attach to an unknown CDP endpoint or an active personal browsing profile.
- Do not send fingerprint data to an external endpoint without consent.
- Do not treat a high score as permission to bypass third-party access controls.
よくある質問
Which browser automation tools are supported?
The skill supports Playwright, Puppeteer, Selenium, and compatible CDP-driven browsers.
Does the skill modify the browser?
No. It measures browser and network signals but does not install stealth patches or profiles.
Can it run without an external request?
Yes. Offline mode runs JavaScript-layer checks without contacting the network observation endpoint.
What does online mode disclose?
It can disclose IP, ASN, HTTP, TLS, ClientHello, and header attributes to the configured endpoint.
Does a high score guarantee detection avoidance?
No. The score measures known consistency checks and cannot predict every external detection system.
What safety step is required for CDP?
Confirm endpoint ownership and use a browser profile without sensitive accounts or pages.