This report is not translated for the requested language. The canonical English report is shown instead.
Versioned security assessment
Report ID: SA-816C62B2
7/7/2026, 12:57:05 AM
playwright-skill security assessment v3
Skill Security Certification Report
Audit model: codex Historical report
- Skill name
- playwright-skill
- Version
- v3
- Maintainer
- sickn33
- Coverage
- 5 Files scanned · 1,806 Lines analyzed
- Policy version
- Unavailable
Highest confirmed finding severity
Critical
7 confirmed security findings require attention.
Installation context
Historical evidence
This report may not describe the currently installable artifact. Open the current Skill page for install guidance.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
Most documentation backtick and example URL detections are false positives. Material risks remain in run.js, which executes generated JavaScript with Node privileges and can install dependencies automatically. Header injection and sandbox-disabled browser launch also need remediation before marketplace auto-install.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
5 Files scanned · 1,806 Lines analyzed
27 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Binding unavailable
Artifact
Identity incomplete
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Observed in 3 evidence locations
Network access
May connect to external services.
Observed in 20 evidence locations
Filesystem access
May read or write local files.
Observed in 37 evidence locations
Env variables
May read values from the process environment.
Observed in 9 evidence locations
External commands
May invoke commands or programs outside the Skill.
Observed in 90 evidence locations
Capability review items (20)
Critical
Dynamic require with variable
require(tempFile);
run.js writes user or model supplied JavaScript to a temp file and loads it with require(). That executes arbitrary local Node.js code.
High
Node.js child_process module
const { execSync } = require('child_process');
run.js imports child_process and uses execSync during dependency setup. This is real process execution from the skill runtime.
High
Synchronous process execution
execSync('npm install', { stdio: 'inherit', cwd: __dirname });
run.js automatically runs npm install when Playwright is missing. That executes an external package-manager command from the skill runtime.
High
Synchronous process execution
execSync('npx playwright install chromium', { stdio: 'inherit', cwd: __dirname });
run.js automatically runs npx playwright install chromium when Playwright is missing. That executes an external command and can fetch browser dependencies.
Medium
Environment variable access (dot notation)
const headerName = process.env.PW_HEADER_NAME;
The helper reads environment variables for custom HTTP header configuration. Those headers can influence requests made by browser contexts.
Medium
Environment variable access (dot notation)
const headerValue = process.env.PW_HEADER_VALUE;
PW_HEADER_VALUE can contain authentication material and is later used as an HTTP header value. That makes this real secret-bearing environment access.
Medium
Environment variable access (dot notation)
const headersJson = process.env.PW_EXTRA_HEADERS;
PW_EXTRA_HEADERS can contain multiple header values and is parsed from the environment. Those values are later applied to browser requests.
Medium
Environment variable object
const headerName = process.env.PW_HEADER_NAME;
The helper reads environment variables for custom HTTP header configuration. Those headers can influence requests made by browser contexts.
Medium
Environment variable object
const headerValue = process.env.PW_HEADER_VALUE;
PW_HEADER_VALUE can contain authentication material and is later used as an HTTP header value. That makes this real secret-bearing environment access.
Medium
Environment variable object
const headersJson = process.env.PW_EXTRA_HEADERS;
PW_EXTRA_HEADERS can contain multiple header values and is parsed from the environment. Those values are later applied to browser requests.
Medium
Node.js fs operations
return fs.readFileSync(filePath, 'utf8');
run.js reads a caller-provided file path as JavaScript for later execution. That is real filesystem access tied to the arbitrary-code executor.
Medium
Node.js fs operations
return fs.readFileSync(0, 'utf8');
run.js reads JavaScript from standard input for later execution. That is real filesystem-style input access tied to the arbitrary-code executor.
Medium
Node.js fs operations
fs.writeFileSync(tempFile, code, 'utf8');
run.js writes generated JavaScript to a temp file inside the skill directory before executing it. This is real local file creation of executable code.
Medium
Synchronous file operations
return fs.readFileSync(filePath, 'utf8');
run.js synchronously reads a caller-provided script before execution. The synchronous API is secondary, but the filesystem access is real.
Medium
Synchronous file operations
return fs.readFileSync(0, 'utf8');
run.js synchronously reads code from standard input before execution. The read feeds the arbitrary-code execution path.
Medium
Synchronous file operations
fs.writeFileSync(tempFile, code, 'utf8');
run.js synchronously writes generated code to a JavaScript file that it then executes. This confirms filesystem write risk.
Low
HTTP/HTTPS request
const req = http.request({
detectDevServers sends HEAD requests to localhost on common development ports. This is intentional local probing, but it is real network behavior.
Low
HTTP client library
const req = http.request({
detectDevServers uses Node http.request to probe local ports. The target is localhost only, so the confirmed risk is limited.
Low
Hardcoded URL
detectedServers.push(`http://localhost:${port}`);
The helper constructs localhost URLs for detected services. This is not external exfiltration, but it is real local network discovery output.
Low
Node.js fs stat operations
if (args.length > 0 && fs.existsSync(args[0])) {
run.js accepts a caller-provided file path and checks whether it exists before execution. This is a real filesystem touch, though the risk is limited.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (7)
RISK-001 Critical
Arbitrary Node.js Execution by Design
The skill tells the agent to write custom Playwright code and run it with run.js. run.js accepts file, inline, or stdin input, writes it to JavaScript, and loads it with require().
The documentation instructs generated script execution, and run.js implements file, inline, and stdin execution through require(). This directly grants generated code local Node.js privileges.
RISK-002 High
Environment file access
const headerValue = process.env.PW_HEADER_VALUE;
This line reads PW_HEADER_VALUE, which can hold credentials or tokens. The value is later propagated into HTTP headers, so the sensitive-data risk is real.
RISK-003 High
Environment file access
const headersJson = process.env.PW_EXTRA_HEADERS;
This line reads PW_EXTRA_HEADERS, which can include credential-bearing headers. The helper later applies those headers to browser contexts.
RISK-004 High
Certificate/key files
...(Object.keys(mergedHeaders).length > 0 && { extraHTTPHeaders: mergedHeaders })
The spread merges environment-derived values into extraHTTPHeaders. This can propagate tokens to visited pages even though no certificate file is accessed.
RISK-005 High
UID/GID manipulation
args: ['--no-sandbox', '--disable-setuid-sandbox']
Chromium is launched with --no-sandbox and --disable-setuid-sandbox by default. Disabling the browser sandbox increases impact from malicious or compromised pages.
RISK-006 High
Unscoped Environment Header Propagation
The skill documents authentication tokens in custom headers and helper code applies environment-derived headers to browser contexts. A token for one target could be sent to another site.
The prose explicitly suggests authentication tokens, and the helper merges those environment values into extraHTTPHeaders. The code does not scope headers to a single origin.
RISK-007 Low
System reconnaissance
hostname: 'localhost',
The helper probes localhost ports to discover running services. The behavior is limited to common dev ports, but it is still local service reconnaissance.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001CriticalUniversal executor runs generated JavaScript with local Node.js privileges.Replace require-based execution with a constrained Playwright runner, or require explicit user confirmation and sandbox generated code.
- FIX-002Highrun.js automatically runs npm and npx commands when Playwright is missing.Move dependency installation to an explicit setup step, pin dependencies with a lockfile, and avoid auto-install during execution.
- FIX-003HighCustom header environment variables can be sent to every browser context.Scope injected headers to approved origins and warn users before using credential-bearing header values.
- FIX-004HighChromium launches with sandbox-disabling flags by default.Remove --no-sandbox defaults and make sandbox disabling an opt-in compatibility setting.
- FIX-005MediumExecutable temp files are written inside the skill directory and cleaned later.Create temp files in the operating system temp directory, restrict accepted script paths, and remove files after execution.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- Unavailable
- Content hash
- Unavailable
- Tree hash
- Unavailable
- Skill path
- Unavailable
- Audit payload hash
- Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable