📦
Audit History
playwright-browser-automation - 9 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v9 Latest | Jul 9, 2026, 01:23 AM | 5 confirmed | 47 | No capability change |
| v8 | Jul 9, 2026, 01:23 AM | 5 confirmed | 47 | No capability change |
| v7 | Jul 6, 2026, 01:28 AM | 3 confirmed | 14 | No capability change |
| v6 | Jun 28, 2026, 05:20 AM | 4 confirmed | 1 | Network accessEnv variables |
| v5 | Jan 16, 2026, 02:28 PM | No confirmed findings | 0 | No capability change |
| v4 | Jan 16, 2026, 02:28 PM | No confirmed findings | 0 | No capability change |
| v3 | Jan 10, 2026, 10:04 AM | No confirmed findings | 0 | No capability change |
| v2 | Jan 10, 2026, 10:04 AM | No confirmed findings | 0 | No capability change |
| v1 | Jan 10, 2026, 10:04 AM | No confirmed findings | 0 | Baseline |
Audit version 9 Latest
Jul 9, 2026, 01:23 AM
The skill is a legitimate Playwright browser automation helper, but it intentionally executes generated JavaScript locally and can install dependencies automatically. Most Markdown backtick, localhost URL, and schema UUID detections are false positives; the confirmed issues center on arbitrary code execution, external commands, weakened Chromium sandboxing, local port probing, and temporary file or screenshot handling.
4
Files scanned
1,533
Lines analyzed
57
Review items
0
False positives ignored
Confirmed security concerns (5)
High
UID/GID manipulation
args: ['--no-sandbox', '--disable-setuid-sandbox']
The browser launches with --no-sandbox and --disable-setuid-sandbox, which weakens Chromium isolation. This may be necessary in containers but increases impact if browser content is compromised.
High
Screen capture upload
// Execution Screenshots - Captured screenshots during execution
The schema models captured execution screenshots and blob storage URLs, which can expose sensitive browser state if connected to runtime storage. The file alone does not upload data, so confidence is moderate.
High
Arbitrary Local JavaScript Execution by Design
The skill directs the agent to generate Playwright scripts, pass inline code or files into run.js, and execute the resulting temporary JavaScript with require(tempFile). This is powerful browser automation, but it also executes local code with the user account privileges.
The documentation and executor implementation clearly describe and implement dynamic execution of caller-provided JavaScript. This is intentional but materially risky for marketplace auto-install use.
Medium
Unrelated Credential and Screenshot Storage Schema Included
The package includes a Prisma schema for workflows, encrypted credentials, webhooks, screenshots, and blob URLs. This is broader than a local Playwright helper and may confuse reviewers about whether sensitive browser data or credentials are stored by the skill.
The schema contains explicit models for screenshots, encrypted credentials, and webhooks, while the skill description is local browser automation. No runtime link was found, so this is a packaging and scope concern rather than proven exfiltration.
Low
System reconnaissance
hostname: 'localhost',
The localhost hostname is used during port probing to discover running dev servers. The scope is local, but it is still reconnaissance of local services.
Capability review items (47)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Database connection strings
url = env("DATABASE_URL")
The Prisma schema references DATABASE_URL, which is a sensitive database connection string if this schema is used. The file is not executed by the skill path, so confidence is limited.
High
Dynamic require with variable
require(tempFile);
run.js writes user-provided or agent-provided code to a temporary file and executes it with require(tempFile). This is arbitrary local JavaScript execution by design.
High
Node.js child_process module
const { execSync } = require('child_process');
run.js imports child_process to install dependencies automatically. This enables local command execution from the skill runner.
High
Synchronous process execution
execSync('npm install', { stdio: 'inherit', cwd: __dirname });
The executor runs npm install or npx playwright install chromium through execSync when Playwright is missing. Automatic package installation is a real supply-chain and command-execution risk.
High
Synchronous process execution
execSync('npx playwright install chromium', { stdio: 'inherit', cwd: __dirname });
The executor runs npm install or npx playwright install chromium through execSync when Playwright is missing. Automatic package installation is a real supply-chain and command-execution risk.
Medium
Ruby/shell backtick execution · 2 occurrences
return `
The template interpolates caller-provided code into an executable wrapper. This supports the skill purpose, but it means untrusted code can run locally if invoked carelessly.
Medium
Node.js fs operations
return fs.readFileSync(filePath, 'utf8');
run.js accepts a caller-supplied file path and reads it if it exists. This is intended for scripts but can read arbitrary local files passed to the executor.
Medium
Node.js fs operations
return fs.readFileSync(0, 'utf8');
run.js reads executable code from stdin. This is intended, but it enables arbitrary code execution through piped input.
Medium
Node.js fs operations
fs.writeFileSync(tempFile, code, 'utf8');
run.js writes caller-provided code into a temporary JavaScript file inside the skill directory before executing it. This is a real executable file creation risk.
Medium
Node.js fs stat operations
if (args.length > 0 && fs.existsSync(args[0])) {
run.js accepts a caller-supplied file path and reads it if it exists. This is intended for scripts but can read arbitrary local files passed to the executor.
Medium
Synchronous file operations
return fs.readFileSync(filePath, 'utf8');
run.js accepts a caller-supplied file path and reads it if it exists. This is intended for scripts but can read arbitrary local files passed to the executor.
Medium
Synchronous file operations
return fs.readFileSync(0, 'utf8');
run.js reads executable code from stdin. This is intended, but it enables arbitrary code execution through piped input.
Medium
Synchronous file operations
fs.writeFileSync(tempFile, code, 'utf8');
run.js writes caller-provided code into a temporary JavaScript file inside the skill directory before executing it. This is a real executable file creation risk.
Medium
Ruby/shell backtick execution · 6 occurrences
```bash
The skill documentation instructs the agent to run shell commands for setup, server detection, or Playwright execution. This is intended behavior, but it is still external command execution.
Medium
Ruby/shell backtick execution
4. I execute it via: `cd $SKILL_DIR && node run.js /tmp/playwright-test-*.js`
The skill documentation instructs the agent to run shell commands for setup, server detection, or Playwright execution. This is intended behavior, but it is still external command execution.
Medium
Temp directory access
2. **Write scripts to /tmp** - NEVER write test files to skill directory; always use `/tmp/playwrigh
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
3. I write custom Playwright code in `/tmp/playwright-test-*.js` (won't clutter your project)
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
4. I execute it via: `cd $SKILL_DIR && node run.js /tmp/playwright-test-*.js`
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
// /tmp/playwright-test-page.js
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
await page.screenshot({ path: '/tmp/screenshot.png', fullPage: true });
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access · 2 occurrences
console.log('📸 Screenshot saved to /tmp/screenshot.png');
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
cd $SKILL_DIR && node run.js /tmp/playwright-test-page.js
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
// /tmp/playwright-test-responsive.js
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
await page.screenshot({ path: '/tmp/desktop.png', fullPage: true });
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
await page.screenshot({ path: '/tmp/mobile.png', fullPage: true });
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
// /tmp/playwright-test-login.js
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
// /tmp/playwright-test-form.js
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
path: '/tmp/screenshot.png',
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
// /tmp/playwright-test-responsive-full.js
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
path: `/tmp/${viewport.name.toLowerCase()}.png`,
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
await page.screenshot({ path: '/tmp/quick-screenshot.png', fullPage: true });
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
- **Use /tmp for test files** - Write to `/tmp/playwright-test-*.js`, never to skill directory or us
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
[Writes custom automation script to /tmp/playwright-test-marketing.js with URL parameterized]
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
[Runs: cd $SKILL_DIR && node run.js /tmp/playwright-test-marketing.js]
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
[Shows results with screenshots from /tmp/]
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
[Writes login automation to /tmp/playwright-test-login.js]
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
[Runs: cd $SKILL_DIR && node run.js /tmp/playwright-test-login.js]
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Low
HTTP/HTTPS request
const req = http.request({
The helper sends HTTP HEAD requests to localhost ports to discover development servers. This is local-only and purposeful, but it is still network probing behavior.
Low
HTTP client library
const req = http.request({
The helper sends HTTP HEAD requests to localhost ports to discover development servers. This is local-only and purposeful, but it is still network probing behavior.
Low
Hardcoded URL
detectedServers.push(`http://localhost:${port}`);
The helper sends HTTP HEAD requests to localhost ports to discover development servers. This is local-only and purposeful, but it is still network probing behavior.
Risk Factors
⚡ Contains scripts (3)
⚙️ External commands (50)
lib/helpers.js:22 lib/helpers.js:102 lib/helpers.js:105 lib/helpers.js:155 lib/helpers.js:163 lib/helpers.js:239 lib/helpers.js:302 lib/helpers.js:357 lib/helpers.js:358 run.js:15 run.js:38 run.js:39 run.js:58 run.js:121-136 run.js:141-153 run.js:181 SKILL.md:10 SKILL.md:13 SKILL.md:14 SKILL.md:15 SKILL.md:24-26 SKILL.md:26-31 SKILL.md:31-33 SKILL.md:33-41 SKILL.md:41-42 SKILL.md:42-48 SKILL.md:48-51 SKILL.md:51-59 SKILL.md:59-61 SKILL.md:61-65 SKILL.md:65-84 SKILL.md:84-88 SKILL.md:88-90 SKILL.md:90-96 SKILL.md:96-118 SKILL.md:118-122 SKILL.md:122-132 SKILL.md:132-144 SKILL.md:144-148 SKILL.md:148-158 SKILL.md:158-171 SKILL.md:171-175 SKILL.md:175-201 SKILL.md:201-202 SKILL.md:202-206 SKILL.md:206-210 SKILL.md:210-235 SKILL.md:235-239 SKILL.md:239-256 SKILL.md:256-267
🌐 Network access (14)
🔑 Env variables (6)
📁 Filesystem access (38)
run.js:59 run.js:71 run.js:88 run.js:95 run.js:185 run.js:56 run.js:59 run.js:71 run.js:185 run.js:188 SKILL.md:13 SKILL.md:14 SKILL.md:13 SKILL.md:14 SKILL.md:15 SKILL.md:31 SKILL.md:41 SKILL.md:42 SKILL.md:66 SKILL.md:79 SKILL.md:80 SKILL.md:89 SKILL.md:97 SKILL.md:110 SKILL.md:114 SKILL.md:123 SKILL.md:149 SKILL.md:224 SKILL.md:228 SKILL.md:240 SKILL.md:267 SKILL.md:287 SKILL.md:342 SKILL.md:377 SKILL.md:378 SKILL.md:379 SKILL.md:394 SKILL.md:395
Detected Patterns
UID/GID manipulationSystem reconnaissanceScreen capture upload
Audited by: claude
Jul 9, 2026, 01:23 AM
The skill is a legitimate Playwright browser automation helper, but it intentionally executes generated JavaScript locally and can install dependencies automatically. Most Markdown backtick, localhost URL, and schema UUID detections are false positives; the confirmed issues center on arbitrary code execution, external commands, weakened Chromium sandboxing, local port probing, and temporary file or screenshot handling.
4
Files scanned
1,533
Lines analyzed
57
Review items
0
False positives ignored
Confirmed security concerns (5)
High
UID/GID manipulation
args: ['--no-sandbox', '--disable-setuid-sandbox']
The browser launches with --no-sandbox and --disable-setuid-sandbox, which weakens Chromium isolation. This may be necessary in containers but increases impact if browser content is compromised.
High
Screen capture upload
// Execution Screenshots - Captured screenshots during execution
The schema models captured execution screenshots and blob storage URLs, which can expose sensitive browser state if connected to runtime storage. The file alone does not upload data, so confidence is moderate.
High
Arbitrary Local JavaScript Execution by Design
The skill directs the agent to generate Playwright scripts, pass inline code or files into run.js, and execute the resulting temporary JavaScript with require(tempFile). This is powerful browser automation, but it also executes local code with the user account privileges.
The documentation and executor implementation clearly describe and implement dynamic execution of caller-provided JavaScript. This is intentional but materially risky for marketplace auto-install use.
Medium
Unrelated Credential and Screenshot Storage Schema Included
The package includes a Prisma schema for workflows, encrypted credentials, webhooks, screenshots, and blob URLs. This is broader than a local Playwright helper and may confuse reviewers about whether sensitive browser data or credentials are stored by the skill.
The schema contains explicit models for screenshots, encrypted credentials, and webhooks, while the skill description is local browser automation. No runtime link was found, so this is a packaging and scope concern rather than proven exfiltration.
Low
System reconnaissance
hostname: 'localhost',
The localhost hostname is used during port probing to discover running dev servers. The scope is local, but it is still reconnaissance of local services.
Capability review items (47)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Database connection strings
url = env("DATABASE_URL")
The Prisma schema references DATABASE_URL, which is a sensitive database connection string if this schema is used. The file is not executed by the skill path, so confidence is limited.
High
Dynamic require with variable
require(tempFile);
run.js writes user-provided or agent-provided code to a temporary file and executes it with require(tempFile). This is arbitrary local JavaScript execution by design.
High
Node.js child_process module
const { execSync } = require('child_process');
run.js imports child_process to install dependencies automatically. This enables local command execution from the skill runner.
High
Synchronous process execution
execSync('npm install', { stdio: 'inherit', cwd: __dirname });
The executor runs npm install or npx playwright install chromium through execSync when Playwright is missing. Automatic package installation is a real supply-chain and command-execution risk.
High
Synchronous process execution
execSync('npx playwright install chromium', { stdio: 'inherit', cwd: __dirname });
The executor runs npm install or npx playwright install chromium through execSync when Playwright is missing. Automatic package installation is a real supply-chain and command-execution risk.
Medium
Ruby/shell backtick execution · 2 occurrences
return `
The template interpolates caller-provided code into an executable wrapper. This supports the skill purpose, but it means untrusted code can run locally if invoked carelessly.
Medium
Node.js fs operations
return fs.readFileSync(filePath, 'utf8');
run.js accepts a caller-supplied file path and reads it if it exists. This is intended for scripts but can read arbitrary local files passed to the executor.
Medium
Node.js fs operations
return fs.readFileSync(0, 'utf8');
run.js reads executable code from stdin. This is intended, but it enables arbitrary code execution through piped input.
Medium
Node.js fs operations
fs.writeFileSync(tempFile, code, 'utf8');
run.js writes caller-provided code into a temporary JavaScript file inside the skill directory before executing it. This is a real executable file creation risk.
Medium
Node.js fs stat operations
if (args.length > 0 && fs.existsSync(args[0])) {
run.js accepts a caller-supplied file path and reads it if it exists. This is intended for scripts but can read arbitrary local files passed to the executor.
Medium
Synchronous file operations
return fs.readFileSync(filePath, 'utf8');
run.js accepts a caller-supplied file path and reads it if it exists. This is intended for scripts but can read arbitrary local files passed to the executor.
Medium
Synchronous file operations
return fs.readFileSync(0, 'utf8');
run.js reads executable code from stdin. This is intended, but it enables arbitrary code execution through piped input.
Medium
Synchronous file operations
fs.writeFileSync(tempFile, code, 'utf8');
run.js writes caller-provided code into a temporary JavaScript file inside the skill directory before executing it. This is a real executable file creation risk.
Medium
Ruby/shell backtick execution · 6 occurrences
```bash
The skill documentation instructs the agent to run shell commands for setup, server detection, or Playwright execution. This is intended behavior, but it is still external command execution.
Medium
Ruby/shell backtick execution
4. I execute it via: `cd $SKILL_DIR && node run.js /tmp/playwright-test-*.js`
The skill documentation instructs the agent to run shell commands for setup, server detection, or Playwright execution. This is intended behavior, but it is still external command execution.
Medium
Temp directory access
2. **Write scripts to /tmp** - NEVER write test files to skill directory; always use `/tmp/playwrigh
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
3. I write custom Playwright code in `/tmp/playwright-test-*.js` (won't clutter your project)
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
4. I execute it via: `cd $SKILL_DIR && node run.js /tmp/playwright-test-*.js`
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
// /tmp/playwright-test-page.js
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
await page.screenshot({ path: '/tmp/screenshot.png', fullPage: true });
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access · 2 occurrences
console.log('📸 Screenshot saved to /tmp/screenshot.png');
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
cd $SKILL_DIR && node run.js /tmp/playwright-test-page.js
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
// /tmp/playwright-test-responsive.js
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
await page.screenshot({ path: '/tmp/desktop.png', fullPage: true });
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
await page.screenshot({ path: '/tmp/mobile.png', fullPage: true });
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
// /tmp/playwright-test-login.js
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
// /tmp/playwright-test-form.js
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
path: '/tmp/screenshot.png',
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
// /tmp/playwright-test-responsive-full.js
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
path: `/tmp/${viewport.name.toLowerCase()}.png`,
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
await page.screenshot({ path: '/tmp/quick-screenshot.png', fullPage: true });
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
- **Use /tmp for test files** - Write to `/tmp/playwright-test-*.js`, never to skill directory or us
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
[Writes custom automation script to /tmp/playwright-test-marketing.js with URL parameterized]
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
[Runs: cd $SKILL_DIR && node run.js /tmp/playwright-test-marketing.js]
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
[Shows results with screenshots from /tmp/]
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
[Writes login automation to /tmp/playwright-test-login.js]
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Medium
Temp directory access
[Runs: cd $SKILL_DIR && node run.js /tmp/playwright-test-login.js]
The skill repeatedly instructs writing executable scripts or screenshots under /tmp. That is intended, but temporary files can expose sensitive page data or executable content on shared systems.
Low
HTTP/HTTPS request
const req = http.request({
The helper sends HTTP HEAD requests to localhost ports to discover development servers. This is local-only and purposeful, but it is still network probing behavior.
Low
HTTP client library
const req = http.request({
The helper sends HTTP HEAD requests to localhost ports to discover development servers. This is local-only and purposeful, but it is still network probing behavior.
Low
Hardcoded URL
detectedServers.push(`http://localhost:${port}`);
The helper sends HTTP HEAD requests to localhost ports to discover development servers. This is local-only and purposeful, but it is still network probing behavior.
Risk Factors
⚡ Contains scripts (3)
⚙️ External commands (50)
lib/helpers.js:22 lib/helpers.js:102 lib/helpers.js:105 lib/helpers.js:155 lib/helpers.js:163 lib/helpers.js:239 lib/helpers.js:302 lib/helpers.js:357 lib/helpers.js:358 run.js:15 run.js:38 run.js:39 run.js:58 run.js:121-136 run.js:141-153 run.js:181 SKILL.md:10 SKILL.md:13 SKILL.md:14 SKILL.md:15 SKILL.md:24-26 SKILL.md:26-31 SKILL.md:31-33 SKILL.md:33-41 SKILL.md:41-42 SKILL.md:42-48 SKILL.md:48-51 SKILL.md:51-59 SKILL.md:59-61 SKILL.md:61-65 SKILL.md:65-84 SKILL.md:84-88 SKILL.md:88-90 SKILL.md:90-96 SKILL.md:96-118 SKILL.md:118-122 SKILL.md:122-132 SKILL.md:132-144 SKILL.md:144-148 SKILL.md:148-158 SKILL.md:158-171 SKILL.md:171-175 SKILL.md:175-201 SKILL.md:201-202 SKILL.md:202-206 SKILL.md:206-210 SKILL.md:210-235 SKILL.md:235-239 SKILL.md:239-256 SKILL.md:256-267
🌐 Network access (14)
🔑 Env variables (6)
📁 Filesystem access (38)
run.js:59 run.js:71 run.js:88 run.js:95 run.js:185 run.js:56 run.js:59 run.js:71 run.js:185 run.js:188 SKILL.md:13 SKILL.md:14 SKILL.md:13 SKILL.md:14 SKILL.md:15 SKILL.md:31 SKILL.md:41 SKILL.md:42 SKILL.md:66 SKILL.md:79 SKILL.md:80 SKILL.md:89 SKILL.md:97 SKILL.md:110 SKILL.md:114 SKILL.md:123 SKILL.md:149 SKILL.md:224 SKILL.md:228 SKILL.md:240 SKILL.md:267 SKILL.md:287 SKILL.md:342 SKILL.md:377 SKILL.md:378 SKILL.md:379 SKILL.md:394 SKILL.md:395
Detected Patterns
UID/GID manipulationSystem reconnaissanceScreen capture upload
Audited by: claude
Jul 6, 2026, 01:28 AM
Most static findings in SKILL.md, helpers.js, and prisma/schema.prisma are false positives from Markdown backticks, example localhost URLs, or schema tokens. The real risks are the run.js arbitrary JavaScript execution workflow, automatic install commands, disabled browser sandbox flags, and localhost service probing.
4
Files scanned
1,533
Lines analyzed
22
Review items
1
False positives ignored
Confirmed security concerns (3)
Critical
Arbitrary JavaScript Execution Workflow
run.js accepts automation code from a file path, inline argument, or standard input, writes it into a temporary JavaScript file, and executes it with require(). This is expected for browser automation, but untrusted prompts can become local code execution.
The data flow is explicit: input code is collected, wrapped, written as JavaScript, and loaded with require(). The skill documentation instructs this workflow.
High
UID/GID manipulation
args: ['--no-sandbox', '--disable-setuid-sandbox']
Browser launch disables the Chromium sandbox with --no-sandbox and --disable-setuid-sandbox. That weakens browser isolation if a tested page is hostile.
Low
System reconnaissance
hostname: 'localhost',
The helper checks localhost ports to discover running development servers. The scope is narrow, but it is still local service reconnaissance.
Capability review items (14)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Dynamic require with variable
require(tempFile);
require(tempFile) loads a generated JavaScript file that contains user-provided automation code. This is arbitrary local code execution by design.
High
Node.js child_process module
const { execSync } = require('child_process');
The child_process module is used by installPlaywright to invoke external install commands. The commands are fixed, but process execution is real.
High
Synchronous process execution
execSync('npm install', { stdio: 'inherit', cwd: __dirname });
execSync runs npm install from the skill directory when Playwright is missing. This can execute package install behavior and modify the local environment.
High
Synchronous process execution
execSync('npx playwright install chromium', { stdio: 'inherit', cwd: __dirname });
execSync runs npx playwright install chromium, which downloads and installs a browser dependency. This is legitimate setup work but high-impact local execution.
High
Node.js fs operations
fs.writeFileSync(tempFile, code, 'utf8');
The runner writes generated JavaScript containing user-provided code to a temp file. That file is immediately loaded for execution.
High
Synchronous file operations
fs.writeFileSync(tempFile, code, 'utf8');
The synchronous write creates an executable JavaScript file from caller-controlled input. This is core behavior but requires sandboxing and review.
Medium
Node.js fs operations
return fs.readFileSync(filePath, 'utf8');
The runner reads a user-supplied file path and treats its contents as automation code. This can expose local file contents to execution flow if misused.
Medium
Node.js fs operations
return fs.readFileSync(0, 'utf8');
The runner reads code from standard input and later executes it. Reading stdin is normal, but here it expands the arbitrary-code execution surface.
Medium
Synchronous file operations
return fs.readFileSync(filePath, 'utf8');
The synchronous read uses a path derived from CLI input. It is intended for scripts, but it can read arbitrary local files passed by the caller.
Medium
Synchronous file operations
return fs.readFileSync(0, 'utf8');
The synchronous read from file descriptor 0 feeds directly into the execution wrapper. This is intended but security-sensitive for untrusted input.
Low
HTTP/HTTPS request
const req = http.request({
detectDevServers sends HTTP HEAD requests to localhost ports. It is disclosed dev-server detection, but it still probes local services.
Low
HTTP client library
const req = http.request({
The helper imports and uses the HTTP client to probe localhost. The target is local, but network access is real.
Low
Hardcoded URL
detectedServers.push(`http://localhost:${port}`);
The code constructs localhost URLs for detected ports. This is intended behavior, but it records and returns discovered local services.
Low
Node.js fs stat operations
if (args.length > 0 && fs.existsSync(args[0])) {
The runner checks whether a user-supplied argument exists as a file path. This is limited, but it touches arbitrary paths provided to the CLI.
Static false positives ignored (1)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
High
Screen capture upload
// Execution Screenshots - Captured screenshots during execution
Force-confirmed blocker/high static finding; AI dismissal overridden.
Risk Factors
⚡ Contains scripts (3)
⚙️ External commands (76)
lib/helpers.js:22 lib/helpers.js:102 lib/helpers.js:105 lib/helpers.js:155 lib/helpers.js:163 lib/helpers.js:239 lib/helpers.js:302 lib/helpers.js:357 lib/helpers.js:358 run.js:15 run.js:38 run.js:39 run.js:58 run.js:121-136 run.js:141-153 run.js:181 SKILL.md:10 SKILL.md:13 SKILL.md:14 SKILL.md:15 SKILL.md:24-26 SKILL.md:26-31 SKILL.md:31-33 SKILL.md:33-41 SKILL.md:41-42 SKILL.md:42-48 SKILL.md:48-51 SKILL.md:51-59 SKILL.md:59-61 SKILL.md:61-65 SKILL.md:65-84 SKILL.md:84-88 SKILL.md:88-90 SKILL.md:90-96 SKILL.md:96-118 SKILL.md:118-122 SKILL.md:122-132 SKILL.md:132-144 SKILL.md:144-148 SKILL.md:148-158 SKILL.md:158-171 SKILL.md:171-175 SKILL.md:175-201 SKILL.md:201-202 SKILL.md:202-206 SKILL.md:206-210 SKILL.md:210-235 SKILL.md:235-239 SKILL.md:239-256 SKILL.md:256-267 SKILL.md:267-275 SKILL.md:275-281 SKILL.md:281-291 SKILL.md:291-299 SKILL.md:299-301 SKILL.md:301-322 SKILL.md:322-324 SKILL.md:324-341 SKILL.md:341-342 SKILL.md:342-343 SKILL.md:343-344 SKILL.md:344-345 SKILL.md:345-346 SKILL.md:346-347 SKILL.md:347 SKILL.md:349-354 SKILL.md:354-356 SKILL.md:356-359 SKILL.md:359-362 SKILL.md:362-365 SKILL.md:365-369 SKILL.md:369-380 SKILL.md:380-382 SKILL.md:382-397 SKILL.md:397-404 SKILL.md:404-405
🌐 Network access (14)
🔑 Env variables (6)
📁 Filesystem access (38)
run.js:59 run.js:71 run.js:88 run.js:95 run.js:185 run.js:56 run.js:59 run.js:71 run.js:185 run.js:188 SKILL.md:13 SKILL.md:14 SKILL.md:13 SKILL.md:14 SKILL.md:15 SKILL.md:31 SKILL.md:41 SKILL.md:42 SKILL.md:66 SKILL.md:79 SKILL.md:80 SKILL.md:89 SKILL.md:97 SKILL.md:110 SKILL.md:114 SKILL.md:123 SKILL.md:149 SKILL.md:224 SKILL.md:228 SKILL.md:240 SKILL.md:267 SKILL.md:287 SKILL.md:342 SKILL.md:377 SKILL.md:378 SKILL.md:379 SKILL.md:394 SKILL.md:395
Detected Patterns
UID/GID manipulationSystem reconnaissance
Audited by: codex
Jun 28, 2026, 05:20 AM
Static analysis found many hits because this skill intentionally runs Playwright automation code and includes documentation examples. Review confirmed unrestricted local JavaScript execution, disabled Chromium sandbox flags, and package-manager execution as real risks. No evidence found of prompt injection or confirmed malicious exfiltration, so this is high risk rather than blocked critical.
4
Files scanned
1,533
Lines analyzed
10
Review items
3
False positives ignored
Confirmed security concerns (4)
High
Unrestricted Local JavaScript Execution
TRUE_POSITIVE: run.js accepts code from a file, inline argument, or stdin, wraps it, writes it to a temporary file, and loads it with require(). This is intended for automation, but it gives generated scripts full local Node.js privileges without sandboxing.
The execution path is explicit and direct. The code is not sanitized or sandboxed before require() runs it in the local Node.js process.
High
Chromium Sandbox Disabled by Default
TRUE_POSITIVE: helper launch options include --no-sandbox and --disable-setuid-sandbox. This may be needed in some containers, but it weakens isolation when visiting untrusted pages.
The flags are hardcoded in the default launch options. The impact depends on the pages visited, but the weakened browser isolation is real.
Medium
Automatic Package Manager Execution
TRUE_POSITIVE: the executor runs npm install and npx playwright install chromium when Playwright is missing. The commands are hardcoded, so command injection is unlikely, but first-run package execution expands supply-chain risk.
The child_process usage is confirmed and hardcoded. The risk is from package-manager execution, not from attacker-controlled shell arguments.
Medium
Broad Local File Read and Temporary File Write
TRUE_POSITIVE: run.js reads any existing path supplied as its first argument and writes generated execution files into the skill directory. This is expected behavior, but it increases impact if untrusted paths or code are provided.
The file operations are direct and synchronous. They are part of the intended executor design, but no path allowlist is enforced.
Needs review findings (1)
These findings came from uncertain legacy audit verdicts, so they require review but are not counted as confirmed security issues.
Medium
prisma/schema.prisma:9-11prisma/schema.prisma:159-177prisma/schema.prisma:203-217prisma/schema.prisma:290-295
Prisma Credential and Screenshot Schema Bundled With Skill
NEEDS_REVIEW: prisma/schema.prisma defines database, credential, webhook, and screenshot storage models. No evidence found that this schema is executed by the Playwright wrapper, but it is unrelated sensitive backend surface in the package.
The sensitive model definitions are present, but search found no reference from the executor or helper files. This appears to be unused bundled material rather than active exfiltration.
Static false positives ignored (3)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
Playwright $$eval Misidentified as eval()
FALSE_POSITIVE: lib/helpers.js uses Playwright $$eval to extract element text from the page. This is not string-based JavaScript eval in the local Node.js process.
The flagged token is a Playwright API method call with a function callback. It does not evaluate attacker-provided source text locally.
Low
Localhost Dev Server Probing Is Expected
FALSE_POSITIVE: helper network access sends HEAD requests only to localhost ports to detect running dev servers. This matches the skill purpose and does not show external exfiltration.
The hostname is fixed to localhost and the method is HEAD. The behavior is disclosed in SKILL.md and supports browser testing workflows.
Low
Documentation Examples Trigger Many Static Hits
FALSE_POSITIVE: many SKILL.md findings are example commands, localhost URLs, /tmp paths, and Playwright snippets. They document expected use rather than hidden executable logic.
The content is in markdown examples and usage instructions. It is still relevant because users may follow it, but it is not hidden code execution by itself.
Risk Factors
⚡ Contains scripts (3)
⚙️ External commands (5)
🌐 Network access (3)
🔑 Env variables (2)
📁 Filesystem access (5)
Detected Patterns
Generated Code Loaded With require()Inline Code Interpolation Into Async WrapperDisabled Browser Sandbox Flags
Audited by: codex
Jan 16, 2026, 02:28 PM
Legitimate browser automation skill. Static findings are false positives: documentation examples in SKILL.md are not executable code, prisma/schema.prisma contains only schema definitions, and Playwright APIs like $$eval were misidentified as eval(). External commands are limited to npm install for Playwright setup, filesystem access is scoped to /tmp for test artifacts.
5
Files scanned
1,801
Lines analyzed
3
Review items
0
False positives ignored
Risk Factors
⚙️ External commands (1)
📁 Filesystem access (2)
⚡ Contains scripts (1)
Audited by: claude
Jan 16, 2026, 02:28 PM
Legitimate browser automation skill. Static findings are false positives: documentation examples in SKILL.md are not executable code, prisma/schema.prisma contains only schema definitions, and Playwright APIs like $$eval were misidentified as eval(). External commands are limited to npm install for Playwright setup, filesystem access is scoped to /tmp for test artifacts.
5
Files scanned
1,801
Lines analyzed
3
Review items
0
False positives ignored
Risk Factors
⚙️ External commands (1)
📁 Filesystem access (2)
⚡ Contains scripts (1)
Audited by: claude
Jan 10, 2026, 10:04 AM
Legitimate browser automation skill with appropriate capabilities. Uses external commands only for Playwright installation, filesystem access limited to skill directory and /tmp for test artifacts, script execution is core purpose.
8
Files scanned
1,796
Lines analyzed
3
Review items
0
False positives ignored
Risk Factors
⚙️ External commands (1)
📁 Filesystem access (2)
⚡ Contains scripts (2)
Audited by: claude
Jan 10, 2026, 10:04 AM
Legitimate browser automation skill with appropriate capabilities. Uses external commands only for Playwright installation, filesystem access limited to skill directory and /tmp for test artifacts, script execution is core purpose.
8
Files scanned
1,796
Lines analyzed
3
Review items
0
False positives ignored
Risk Factors
⚙️ External commands (1)
📁 Filesystem access (2)
⚡ Contains scripts (2)
Audited by: claude
Jan 10, 2026, 10:04 AM
Legitimate browser automation skill with appropriate capabilities. Uses external commands only for Playwright installation, filesystem access limited to skill directory and /tmp for test artifacts, script execution is core purpose.
8
Files scanned
1,796
Lines analyzed
3
Review items
0
False positives ignored
Risk Factors
⚙️ External commands (1)
📁 Filesystem access (2)
⚡ Contains scripts (2)
Audited by: claude