Skills playwright-browser-automation

📦

playwright-browser-automation

Name: playwright-browser-automation
Author: DataFlight

v1.0.0 Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access

Automate Browser Testing with Playwright

Manual browser checks are slow and inconsistent. This skill helps Claude, Codex, and Claude Code create Playwright scripts for testing, screenshots, forms, and responsive layouts.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

This skill is part of 2 packs

Install the whole pack to get every skill the task needs, in one command.

Dev Release Regression Check · 3 skills Install whole pack OpenClaw Feishu Ops Assistant · 3 skills Install whole pack

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "playwright-browser-automation" from https://skillstore.io/skills/dataflightsolutions-playwright-browser-automation.md and its manifest at https://skillstore.io/api/skills/dataflightsolutions-playwright-browser-automation/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/dataflightsolutions-playwright-browser-automation.md Signed manifest GET /api/skills/dataflightsolutions-playwright-browser-automation/manifest Signed lockfile GET /api/skills/dataflightsolutions-playwright-browser-automation/lockfile

Test it

Using "playwright-browser-automation". Check the local dashboard and take a screenshot.

Expected outcome:

Detected one local server, opened the dashboard, saved a screenshot, and reported the page title and URL.

Using "playwright-browser-automation". Test the login flow on my staging URL.

Expected outcome:

Filled the login form, submitted it, confirmed the dashboard redirect, and noted any console errors.

Using "playwright-browser-automation". Review this landing page on mobile and desktop.

Expected outcome:

Captured screenshots for each viewport and summarized visible spacing, overflow, and navigation issues.

Security Audit

High Risk

v8 • 7/5/2026 Open versioned report

Most static external-command hits are Markdown or JavaScript backtick false positives. Real risks remain because the skill runs Node and npm commands, executes generated Playwright scripts from /tmp, and saves screenshots to shared temporary paths. I found no evidence of prompt injection, hidden external callbacks, or obfuscated payloads in SKILL.md.

Files scanned

463

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

High

SKILL.md:39-41 SKILL.md:75-76

Generated Script Execution From Shared Temporary Directory

The workflow tells the agent to write custom Playwright scripts to /tmp and run them with node run.js. This combines generated code execution with shared temporary storage.

The instructions explicitly require /tmp script creation and a Node wrapper command. The risk is contextual and comes from combining these steps.

Capability review items (15)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:75-77

Ruby/shell backtick execution

```bash

This bash block runs node run.js against a generated script in /tmp. Executing generated JavaScript from a shared temp location is real local code execution risk.

High

SKILL.md:411-420

Ruby/shell backtick execution

```bash

This inline execution block runs node run.js with JavaScript supplied in the command. It is intentional local code execution and should require user confirmation.

High

SKILL.md:76

Temp directory access

cd ${CLAUDE_PLUGIN_ROOT} && node run.js /tmp/playwright-test-{name}.js

The skill directs generated scripts to /tmp and later runs them with Node. Shared temporary paths can be replaced, collide, or expose generated automation code.

Medium

SKILL.md:30-32

Ruby/shell backtick execution

```bash

This bash block instructs the agent to run a Node one-liner from the plugin directory to detect dev servers. It is intentional external command execution with fixed arguments.

Medium

SKILL.md:85-87

Ruby/shell backtick execution

```bash

This bash block tells the user to run npm run setup from the plugin directory. Package scripts can execute local install code, so confirmation is warranted.

Medium

SKILL.md:439-441

Ruby/shell backtick execution

```bash

This troubleshooting block tells the user to run npm run setup from the plugin directory. Package scripts can execute local install code, so confirmation is warranted.

Medium

SKILL.md:41

Temp directory access

NEVER write test files to plugin directory. Always use `/tmp/playwright-test-*.js`

The skill directs generated scripts to /tmp and later runs them with Node. Shared temporary paths can be replaced, collide, or expose generated automation code.

Medium

SKILL.md:45

Temp directory access

// /tmp/playwright-test-{descriptive-name}.js

The skill directs generated scripts to /tmp and later runs them with Node. Shared temporary paths can be replaced, collide, or expose generated automation code.

Medium

SKILL.md:62

Temp directory access

await page.screenshot({ path: '/tmp/screenshot.png', fullPage: true });