此报告尚无所请求语言的翻译，当前显示规范英文报告。
版本化安全评估
报告编号: SA-7DB9B9F0
7/9/2026, 1:18:22 AM
browsing-with-playwright 安全评估 v10
Skill 安全认证报告
审计模型: claude 最新发布的报告
- 技能名称
- browsing-with-playwright
- 版本
- v10
- 维护者
- Asmayaseen
- 覆盖范围
- 6 已扫描文件 · 1,567 分析行数
- 策略版本
- 不可用
已确认问题的最高严重性
高
有 2 个已确认的安全问题需要处理。
安装上下文
请查看当前 Skill 详情页
本页仅汇总报告证据。Skill 详情页提供 canonical install advisory。
打开当前 Skill 详情页本报告不会阻止或授权 manifest 或 ZIP。
Most static findings are false positives from Markdown examples, JSON Schema URLs, generated reference documentation, or fixed health-check commands. Real risks remain because the skill can launch a user-supplied stdio MCP command, send MCP requests to configured endpoints, manage local processes through /tmp PID files, and execute arbitrary Playwright code in a shared browser context.
报告位置
最新发布的报告
“最新”仅指报告序列，不代表 artifact 当前有效。
审计证明
无法签发证明
所需的不可变绑定不完整。
人工验证
未进行人工验证
本报告没有人工验证记录。
覆盖范围
6 已扫描文件 · 1,567 分析行数
有 25 项内容需要查看
局限
本报告不声称进行了运行时或沙箱执行，也不证明不存在副作用。
证据链
证据从来源绑定延伸到安装契约。证据可用于验证，但不是安全保证。
来源
已绑定 commit 与路径
构件
已绑定内容与 tree hash
审计
已完成
观察到的能力
“已观察到”表示本报告记录了支持证据；“未记录”不证明该能力不存在。
包含脚本
可能执行 Skill 随附的代码。
本次审计未记录
网络访问
可能连接外部服务。
在 49 个证据位置观察到
文件系统访问
可能读取或写入本地文件。
在 9 个证据位置观察到
环境变量
可能读取进程环境中的值。
本次审计未记录
外部命令
可能调用 Skill 之外的命令或程序。
在 43 个证据位置观察到
能力复核项 (23)
高
Python subprocess.Popen
self._process = subprocess.Popen(
StdioTransport starts a user-supplied --stdio command with shell=True. This is intended MCP functionality, but it is real arbitrary local command execution if untrusted input reaches the argument.
中
Shell command substitution
if [ -f "$PID_FILE" ] && kill -0 $(cat "$PID_FILE") 2>/dev/null; then
The script reads a PID from a predictable /tmp file inside command substitution before passing it to kill. This is local process-control logic with limited tampering risk.
中
Shell command substitution
echo "Playwright MCP already running on port $PORT (PID: $(cat $PID_FILE))"
The script reads a PID from a predictable /tmp file inside command substitution before passing it to kill. This is local process-control logic with limited tampering risk.
中
Shell command substitution
if kill -0 $(cat "$PID_FILE") 2>/dev/null; then
The script reads a PID from a predictable /tmp file inside command substitution before passing it to kill. This is local process-control logic with limited tampering risk.
中
Shell command substitution
echo "Playwright MCP started on port $PORT (PID: $(cat $PID_FILE))"
The script reads a PID from a predictable /tmp file inside command substitution before passing it to kill. This is local process-control logic with limited tampering risk.
中
Temp directory access
PID_FILE="/tmp/playwright-mcp-${PORT}.pid"
The helper stores and reads a predictable PID file under /tmp. This is common lifecycle code, but it creates a local tampering surface.
中
Shell command substitution
PID=$(cat "$PID_FILE")
The script reads a PID file and uses the value for process termination. This is intended cleanup behavior with a limited local tampering risk.
中
Shell command substitution
python3 "$(dirname "$0")/mcp-client.py" call -u "http://localhost:${PORT}" -t browser_close -p '{}'
The script invokes a local Python MCP client and derives the script directory in shell. It is intended cleanup behavior, but it is still external command execution.
中
Temp directory access
PID_FILE="/tmp/playwright-mcp-${PORT}.pid"
The stop helper reads, deletes, and acts on a predictable /tmp PID file. This is normal lifecycle code but has a local tampering surface.
低
HTTP client library
def request(self, method: str, params: Optional[dict] = None) -> dict:
The MCP client sends JSON-RPC requests to a user-provided HTTP server URL. This is legitimate for MCP, but it is real network capability and can disclose tool parameters to that endpoint.
低
HTTP client library
def request(self, method: str, params: Optional[dict] = None) -> dict:
The MCP client sends JSON-RPC requests to a user-provided HTTP server URL. This is legitimate for MCP, but it is real network capability and can disclose tool parameters to that endpoint.
低
HTTP client library
result = self.transport.request("tools/list")
The MCP client sends JSON-RPC requests to a user-provided HTTP server URL. This is legitimate for MCP, but it is real network capability and can disclose tool parameters to that endpoint.
低
HTTP client library
result = self.transport.request("tools/call", params)
The MCP client sends JSON-RPC requests to a user-provided HTTP server URL. This is legitimate for MCP, but it is real network capability and can disclose tool parameters to that endpoint.
低
HTTP client library
result = self.transport.request("resources/list")
The MCP client sends JSON-RPC requests to a user-provided HTTP server URL. This is legitimate for MCP, but it is real network capability and can disclose tool parameters to that endpoint.
低
HTTP client library
result = self.transport.request("prompts/list")
The MCP client sends JSON-RPC requests to a user-provided HTTP server URL. This is legitimate for MCP, but it is real network capability and can disclose tool parameters to that endpoint.
低
Python HTTP libraries
from urllib.request import Request, urlopen
The imported urllib client is used to contact the configured MCP HTTP endpoint. This is expected, but it confirms runtime network access.
低
Standard device file access
if [ -f "$PID_FILE" ] && kill -0 $(cat "$PID_FILE") 2>/dev/null; then
The helper stores and reads a predictable PID file under /tmp. This is common lifecycle code, but it creates a local tampering surface.
低
Standard device file access
if kill -0 $(cat "$PID_FILE") 2>/dev/null; then
The helper stores and reads a predictable PID file under /tmp. This is common lifecycle code, but it creates a local tampering surface.
低
Standard device file access
if kill -0 "$PID" 2>/dev/null; then
The stop helper reads, deletes, and acts on a predictable /tmp PID file. This is normal lifecycle code but has a local tampering surface.
低
Standard device file access
python3 "$(dirname "$0")/mcp-client.py" call -u "http://localhost:${PORT}" -t browser_close -p '{}'
The stop helper reads, deletes, and acts on a predictable /tmp PID file. This is normal lifecycle code but has a local tampering surface.
低
Standard device file access
kill "$PID" 2>/dev/null
The stop helper reads, deletes, and acts on a predictable /tmp PID file. This is normal lifecycle code but has a local tampering surface.
低
Standard device file access
kill -9 "$PID" 2>/dev/null || true
The stop helper reads, deletes, and acts on a predictable /tmp PID file. This is normal lifecycle code but has a local tampering surface.
低
Standard device file access
pkill -f "@playwright/mcp.*--port.*${PORT}" 2>/dev/null && echo "Playwright MCP stopped" || echo "Pl
The stop helper reads, deletes, and acts on a predictable /tmp PID file. This is normal lifecycle code but has a local tampering surface.
风险问题
已确认的安全问题与仍需审核的项目分开展示。
已确认安全问题 (2)
RISK-001 高
Arbitrary browser code execution capability
The skill instructs users to call browser_run_code with supplied Playwright code. This is a powerful browser automation feature that can read page content and act in the active shared browser context if misused.
The documented workflow explicitly passes a code string to browser_run_code. The risk is contextual because trusted users may need it, but untrusted prompts could abuse it.
RISK-002 中
Shared browser context may expose session state
The skill requires --shared-browser-context so browser state persists across MCP client calls. Persistent session state can expose authenticated pages or cookies during later browser automation tasks.
The documentation clearly requires a shared browser context and advises keeping the server running for long sessions. This creates a real privacy boundary concern, although it is not inherently malicious.
补救措施
本次审计记录了建议的修复措施。实施这些措施是维护者的责任。
- FIX-001高Stdio MCP transport executes a user-supplied command with shell=True.Parse stdio commands into an argument list and run subprocess.Popen with shell=False, or remove stdio support if this skill only needs local Playwright HTTP MCP.
- FIX-002高browser_run_code can execute arbitrary Playwright code in a shared browser context.Warn users not to run browser code from untrusted prompts and recommend closing the browser or using an isolated context after sensitive sessions.
- FIX-003中Helper scripts use predictable /tmp PID files for process control.Store PID files in a user-owned runtime directory with restrictive permissions, validate PID contents as digits, and quote command substitutions consistently.
专家证据
不可变主体身份、扫描器元数据、已排除匹配项和源码级证据。
Artifact 主体
- Marketplace 提交
- 7db9b9f06e0ab79c575b58bc48c4d8dc9849f424
- 内容哈希
- a29591ec42e473e12b98ce90c31254c440e0d13e9d6b11168f6cf4ab785cb8cd
- 目录树哈希
- d68e022e07e2ea22cdc2c9fbb0356a16ff6d6b28bc1a012668ef2685e86883dc
- Skill 路径
- skills/asmayaseen/browsing-with-playwright
- 审计载荷哈希
- 5657f92e5c83150693eeb3e94f85cdf7
分析元数据
审计模型: claude
分析状态: 已完成
范围仅限于已记录的文件、行数、方法和证据；本报告不声称进行了运行时或沙箱执行。
验证与导出
manifest 和 lockfile 将安装 artifact 绑定到加密哈希。该完整性声明独立于安全评估。
审计证明: not_attestable