Skills browsing-with-playwright

📦

browsing-with-playwright

Name: browsing-with-playwright
Author: Asmayaseen

Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access

Automate Browsing with Playwright MCP

Manual browser testing and data collection can be slow and hard to repeat. This skill gives Claude, Codex, and Claude Code a local Playwright MCP workflow for controlled browser actions.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "browsing-with-playwright" from https://skillstore.io/skills/asmayaseen-browsing-with-playwright.md and its manifest at https://skillstore.io/api/skills/asmayaseen-browsing-with-playwright/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/asmayaseen-browsing-with-playwright.md Signed manifest GET /api/skills/asmayaseen-browsing-with-playwright/manifest Signed lockfile GET /api/skills/asmayaseen-browsing-with-playwright/lockfile

Test it

Using "browsing-with-playwright". Check whether the signup page loads and has email and password fields.

Expected outcome:

The page loaded successfully. The snapshot shows email and password fields, a submit button, and a terms checkbox. A screenshot was captured for review.

Using "browsing-with-playwright". Submit the contact form with the test values and confirm the result.

Expected outcome:

The form was filled and submitted. The page displayed a success message, and the final screen was saved as evidence.

Using "browsing-with-playwright". Extract the visible product names from the catalog page.

Expected outcome:

Opened the catalog page.
Captured the page state after loading.
Returned the visible product names and noted items hidden behind pagination.

Security Audit

High Risk

v10 • 7/9/2026 Open versioned report

Most static findings are false positives from Markdown examples, JSON Schema URLs, generated reference documentation, or fixed health-check commands. Real risks remain because the skill can launch a user-supplied stdio MCP command, send MCP requests to configured endpoints, manage local processes through /tmp PID files, and execute arbitrary Playwright code in a shared browser context.

Files scanned

1,567

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

SKILL.md:109-116

Arbitrary browser code execution capability

The skill instructs users to call browser_run_code with supplied Playwright code. This is a powerful browser automation feature that can read page content and act in the active shared browser context if misused.

The documented workflow explicitly passes a code string to browser_run_code. The risk is contextual because trusted users may need it, but untrusted prompts could abuse it.

Medium

SKILL.md:35-40

Shared browser context may expose session state

The skill requires --shared-browser-context so browser state persists across MCP client calls. Persistent session state can expose authenticated pages or cookies during later browser automation tasks.

The documentation clearly requires a shared browser context and advises keeping the server running for long sessions. This creates a real privacy boundary concern, although it is not inherently malicious.

Capability review items (23)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/mcp-client.py:204

Python subprocess.Popen

self._process = subprocess.Popen(

StdioTransport starts a user-supplied --stdio command with shell=True. This is intended MCP functionality, but it is real arbitrary local command execution if untrusted input reaches the argument.

Medium

scripts/start-server.sh:9

Shell command substitution

if [ -f "$PID_FILE" ] && kill -0 $(cat "$PID_FILE") 2>/dev/null; then

The script reads a PID from a predictable /tmp file inside command substitution before passing it to kill. This is local process-control logic with limited tampering risk.

Medium

scripts/start-server.sh:10

Shell command substitution

echo "Playwright MCP already running on port $PORT (PID: $(cat $PID_FILE))"

The script reads a PID from a predictable /tmp file inside command substitution before passing it to kill. This is local process-control logic with limited tampering risk.

Medium

scripts/start-server.sh:20

Shell command substitution

if kill -0 $(cat "$PID_FILE") 2>/dev/null; then

The script reads a PID from a predictable /tmp file inside command substitution before passing it to kill. This is local process-control logic with limited tampering risk.

Medium

scripts/start-server.sh:21

Shell command substitution

echo "Playwright MCP started on port $PORT (PID: $(cat $PID_FILE))"

The script reads a PID from a predictable /tmp file inside command substitution before passing it to kill. This is local process-control logic with limited tampering risk.

Medium

scripts/start-server.sh:6

Temp directory access

PID_FILE="/tmp/playwright-mcp-${PORT}.pid"

The helper stores and reads a predictable PID file under /tmp. This is common lifecycle code, but it creates a local tampering surface.

Medium

scripts/stop-server.sh:9

Shell command substitution

PID=$(cat "$PID_FILE")

The script reads a PID file and uses the value for process termination. This is intended cleanup behavior with a limited local tampering risk.

Medium

scripts/stop-server.sh:12

Shell command substitution

python3 "$(dirname "$0")/mcp-client.py" call -u "http://localhost:${PORT}" -t browser_close -p '{}'

The script invokes a local Python MCP client and derives the script directory in shell. It is intended cleanup behavior, but it is still external command execution.

Medium

scripts/stop-server.sh:6

Temp directory access

PID_FILE="/tmp/playwright-mcp-${PORT}.pid"

The stop helper reads, deletes, and acts on a predictable /tmp PID file. This is normal lifecycle code but has a local tampering surface.

Low

scripts/mcp-client.py:146

HTTP client library

def request(self, method: str, params: Optional[dict] = None) -> dict:

The MCP client sends JSON-RPC requests to a user-provided HTTP server URL. This is legitimate for MCP, but it is real network capability and can disclose tool parameters to that endpoint.

Low

scripts/mcp-client.py:271

HTTP client library

def request(self, method: str, params: Optional[dict] = None) -> dict:

The MCP client sends JSON-RPC requests to a user-provided HTTP server URL. This is legitimate for MCP, but it is real network capability and can disclose tool parameters to that endpoint.

Low

scripts/mcp-client.py:314

HTTP client library

result = self.transport.request("tools/list")

The MCP client sends JSON-RPC requests to a user-provided HTTP server URL. This is legitimate for MCP, but it is real network capability and can disclose tool parameters to that endpoint.

Low

scripts/mcp-client.py:323

HTTP client library

result = self.transport.request("tools/call", params)

The MCP client sends JSON-RPC requests to a user-provided HTTP server URL. This is legitimate for MCP, but it is real network capability and can disclose tool parameters to that endpoint.

Low

scripts/mcp-client.py:328

HTTP client library

result = self.transport.request("resources/list")

The MCP client sends JSON-RPC requests to a user-provided HTTP server URL. This is legitimate for MCP, but it is real network capability and can disclose tool parameters to that endpoint.

Low

scripts/mcp-client.py:333

HTTP client library

result = self.transport.request("prompts/list")

The MCP client sends JSON-RPC requests to a user-provided HTTP server URL. This is legitimate for MCP, but it is real network capability and can disclose tool parameters to that endpoint.

Low

scripts/mcp-client.py:33

Python HTTP libraries

from urllib.request import Request, urlopen

The imported urllib client is used to contact the configured MCP HTTP endpoint. This is expected, but it confirms runtime network access.

Low

scripts/start-server.sh:9

Standard device file access

if [ -f "$PID_FILE" ] && kill -0 $(cat "$PID_FILE") 2>/dev/null; then

The helper stores and reads a predictable PID file under /tmp. This is common lifecycle code, but it creates a local tampering surface.

Low

scripts/start-server.sh:20

Standard device file access

if kill -0 $(cat "$PID_FILE") 2>/dev/null; then

The helper stores and reads a predictable PID file under /tmp. This is common lifecycle code, but it creates a local tampering surface.

Low

scripts/stop-server.sh:10

Standard device file access

if kill -0 "$PID" 2>/dev/null; then

The stop helper reads, deletes, and acts on a predictable /tmp PID file. This is normal lifecycle code but has a local tampering surface.

Low

scripts/stop-server.sh:12

Standard device file access

python3 "$(dirname "$0")/mcp-client.py" call -u "http://localhost:${PORT}" -t browser_close -p '{}'

The stop helper reads, deletes, and acts on a predictable /tmp PID file. This is normal lifecycle code but has a local tampering surface.

Low

scripts/stop-server.sh:15

Standard device file access

kill "$PID" 2>/dev/null

The stop helper reads, deletes, and acts on a predictable /tmp PID file. This is normal lifecycle code but has a local tampering surface.

Low

scripts/stop-server.sh:19

Standard device file access

kill -9 "$PID" 2>/dev/null || true

The stop helper reads, deletes, and acts on a predictable /tmp PID file. This is normal lifecycle code but has a local tampering surface.

Low

scripts/stop-server.sh:28

Standard device file access

pkill -f "@playwright/mcp.*--port.*${PORT}" 2>/dev/null && echo "Playwright MCP stopped" || echo "Pl

The stop helper reads, deletes, and acts on a predictable /tmp PID file. This is normal lifecycle code but has a local tampering surface.

Risk Factors

⚙️ External commands (43)

references/playwright-tools.md:247 references/playwright-tools.md:308 references/playwright-tools.md:471-480 references/playwright-tools.md:515-533 scripts/mcp-client.py:191 scripts/mcp-client.py:204 scripts/mcp-client.py:348 scripts/mcp-client.py:371 scripts/mcp-client.py:377-379 scripts/start-server.sh:9 scripts/start-server.sh:10 scripts/start-server.sh:20 scripts/start-server.sh:21 scripts/start-server.sh:1 scripts/stop-server.sh:9 scripts/stop-server.sh:12 scripts/stop-server.sh:1 scripts/verify.py:8 SKILL.md:17-23 SKILL.md:23-26 SKILL.md:26-33 SKILL.md:33-40 SKILL.md:40-46 SKILL.md:46-53 SKILL.md:53-57 SKILL.md:57-64 SKILL.md:64-68 SKILL.md:68-70 SKILL.md:70-86 SKILL.md:86-90 SKILL.md:90-98 SKILL.md:98-102 SKILL.md:102-105 SKILL.md:105-109 SKILL.md:109-111 SKILL.md:111-114 SKILL.md:114-116 SKILL.md:116-136 SKILL.md:136-138 SKILL.md:138-142 SKILL.md:142-144 SKILL.md:144-157 SKILL.md:157-159

🌐 Network access (49)

📁 Filesystem access (9)

scripts/start-server.sh:9 scripts/start-server.sh:20 scripts/start-server.sh:6 scripts/stop-server.sh:10 scripts/stop-server.sh:12 scripts/stop-server.sh:15 scripts/stop-server.sh:19 scripts/stop-server.sh:28 scripts/stop-server.sh:6

Audited by: claude View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/asmayaseen-browsing-with-playwright/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/asmayaseen-browsing-with-playwright/security.svg)](https://skillstore.io/skills/asmayaseen-browsing-with-playwright?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/asmayaseen-browsing-with-playwright?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/asmayaseen-browsing-with-playwright/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/asmayaseen-browsing-with-playwright.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

Asmayaseen. (2026). browsing-with-playwright security audit report (audit version 10) [Author version unspecified]. Skillstore. https://skillstore.io/skills/asmayaseen-browsing-with-playwright/audits/10

BibTeX citation

@techreport{asmayaseen-asmayaseen-browsing-with-playwright-2026,
  author = {Asmayaseen},
  title = {browsing-with-playwright security audit report (audit version 10)},
  institution = {Skillstore},
  year = {2026},
  number = {10},
  url = {https://skillstore.io/skills/asmayaseen-browsing-with-playwright/audits/10},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "browsing-with-playwright security audit report (audit version 10)"
version: "unspecified"
type: report
authors:
  - name: "Asmayaseen"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/asmayaseen-browsing-with-playwright/audits/10"
identifiers:
  - type: other
    value: "skillstore:asmayaseen-browsing-with-playwright:audit:10"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Test a web form end to end

Navigate to a page, fill fields, submit the form, wait for confirmation, and capture proof with a screenshot.

Inspect a browser-only workflow

Use snapshots, clicks, waits, and screenshots to understand dynamic pages that need JavaScript execution.

Extract visible page data

Open a page, collect text through snapshots or browser evaluation, and summarize the result for a research task.

Try These Prompts

Open a page and report what is visible

Use the Playwright browser skill to open the page I provide. Take a snapshot, summarize the visible sections, and tell me if the page loaded correctly.

Fill and submit a simple form

Start the Playwright MCP server, open this form, fill the fields with the values I provide, submit it, and capture the confirmation screen.

Debug a dynamic UI state

Use browser snapshots and screenshots to reproduce this UI issue. Click through the stated steps, wait for each state change, and report the observed behavior.

Run a multi-step extraction workflow

Use Playwright MCP to navigate through the target pages, run safe page evaluation for the requested data, and return a concise table of findings with source pages.

Best Practices

Take a fresh browser_snapshot before clicking or typing so element references are current.
Stop the Playwright MCP server when browser work is complete, especially after authenticated sessions.
Use browser_run_code only for trusted workflows and prefer targeted tool calls for simple actions.

Avoid

Do not use this skill for static downloads when a direct HTTP fetch is sufficient.
Do not reuse a shared browser context for unrelated users or sensitive accounts.
Do not run Playwright code copied from untrusted pages, prompts, or tickets.