All 37 static findings are false positives caused by Markdown code formatting, expected browser commands, benign example URLs, and a comment. One medium semantic risk remains: the fallback installation uses a mutable package version globally, increasing supply-chain and host impact.
The fallback command installs @playwright/cli@latest globally. A mutable version and global scope increase supply-chain exposure and host-wide impact.
The installation command explicitly combines global scope with the mutable latest tag. The behavior is clear even though the named package is legitimate.
Most static hits are Markdown backticks or documented example URLs, not hidden code execution. Confirmed risks remain because the skill directs agents to run Playwright CLI and package-manager commands, including browser actions, JavaScript evaluation, file snapshots, and a global npm install. No prompt injection attempt was found in SKILL.md.
The allowed-tools front matter permits Bash(npx:*) and Bash(npm:*). This grants package manager execution beyond the specific commands shown, which can install or run arbitrary package code if invoked.
The permission block explicitly grants wildcard npm and npx command access. This is a broader tool authorization risk than the individual Markdown command examples.
Capability review items (11)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The npm install -g command fetches and installs @playwright/cli@latest globally, which can execute package lifecycle code and modifies the host environment. The unpinned latest version increases supply-chain risk.
The block instructs running playwright-cli commands that open a browser, navigate to a URL, click, type, and close. These are intended operations but still allow browser automation against live pages, so the external-command risk is real.
Most static findings are Markdown inline code or fenced examples, not Ruby shell backtick execution or malicious networking. The main residual concern is the recommendation to globally install an unpinned npm package with @latest.
The skill recommends installing @playwright/cli globally with the @latest tag. This fetches unpinned code and changes the host toolchain outside the project.
Line 171 contains a global npm install using @latest, which is a concrete supply-chain and environment mutation risk. The behavior is legitimate installation guidance, but it should be pinned and confirmed.