Versioned security assessment

Report ID: SA-BC401E53

6/30/2026, 8:07:14 AM

playwright-cli security assessment v2

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
playwright-cli
Version
v2
Maintainer
microsoft
Source
github.com/microsoft/playwright-cli/tree/main/skills/playwright-cli/
Coverage
7 Files scanned · 1,149 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Medium

4 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The static command findings are mostly false positives from markdown command examples, not Ruby backtick execution. The skill is still medium risk because it intentionally allows browser automation, arbitrary Playwright page code, network navigation, storage-state files, persistent profiles, and trace artifacts that can expose sensitive session data. No prompt injection attempt or confirmed malicious exfiltration path was found.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

7 Files scanned · 1,149 Lines analyzed

4 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 4 evidence locations

Network access

May connect to external services.

Observed in 4 evidence locations

Filesystem access

May read or write local files.

Observed in 4 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 4 evidence locations

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (4)

RISK-001 Medium
SKILL.md:104-132references/storage-state.md:7-27references/storage-state.md:231-247references/storage-state.md:269-275
Browser Storage State Can Expose Sessions
The skill documents saving, loading, listing, and editing cookies, localStorage, sessionStorage, and authentication state files. This is legitimate for testing, but saved state can contain session tokens and must be protected.
The lines explicitly show state-save, state-load, cookie commands, and security notes about auth tokens. The context is legitimate automation, so the risk is exposure through misuse rather than confirmed malicious intent.
RISK-002 Medium
SKILL.md:47-48SKILL.md:147-151references/running-code.md:1-11references/running-code.md:173-185
Arbitrary Playwright Code Execution in Browser Context
The skill supports run-code and eval commands that execute user supplied Playwright or JavaScript snippets in the active browser session. This enables advanced testing, but it can read page content, grant browser permissions, and manipulate storage.
The commands are directly documented and the examples show page evaluation and permission changes. The capability is expected for a Playwright CLI skill, but it increases impact if misused.
RISK-003 Medium
references/tracing.md:1-3references/tracing.md:34-43references/tracing.md:87-100references/video-recording.md:1-18
Trace and Video Artifacts May Capture Sensitive Data
Tracing records DOM snapshots, screenshots, network requests, headers, bodies, and console logs. Video recording and traces can preserve secrets typed during automated flows.
The reference states that traces capture network bodies, DOM snapshots, screenshots, and checkout form inputs. This is strong evidence of sensitive artifact risk without evidence of automatic exfiltration.
RISK-004 Medium
SKILL.md:168-179SKILL.md:201-214
Persistent Browser Profiles Retain Local Data
The skill supports persistent sessions and custom profile directories. Persistent profiles can keep cookies, local storage, and other browser data beyond the immediate automation task.
The documented commands explicitly create persistent sessions and provide cleanup commands. The risk is manageable, but users must understand retention and delete data after sensitive workflows.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (3)
Low
SKILL.md:11-23references/request-mocking.md:7-26references/running-code.md:7-12references/test-generation.md:12-32
Static External Command Matches Are Mostly Documentation Examples
The many Ruby or shell backtick detections occur in fenced markdown blocks that show playwright-cli usage. They are not Ruby backtick execution in source code, although the skill intentionally allows the playwright-cli command.
The cited locations are markdown command examples, not executable Ruby code. The allowed Bash wrapper is real, but the specific static Ruby backtick label is a false positive.
Low
SKILL.md:15SKILL.md:33-34references/running-code.md:210-226references/tracing.md:118-123
Hardcoded URLs Are Example Targets
The hardcoded URL findings use documentation domains such as example.com and playwright.dev. I did not find evidence that these URLs receive secrets or hidden telemetry.
The URL examples are clearly part of user-facing command documentation and test workflows. No evidence found of a fixed third-party collection endpoint.
Low
SKILL.md:1-5
Prompt Injection Search Found No Evidence
No reviewed file contained suspicious override language, fake system instructions, pre-approval claims, or requests to skip analysis.
Targeted review of the skill and references found no prompt injection phrases. The confidence is high, but this finding is limited to the files included in the audit.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable