此报告尚无所请求语言的翻译，当前显示规范英文报告。

版本化安全评估

报告编号: SA-7E9E368D

7/5/2026, 9:19:13 AM

playwright-browser-automation 安全评估 v8

Skill 安全认证报告

审计历史
审计模型: codex 最新发布的报告
技能名称
playwright-browser-automation
版本
v1.0.0
维护者
DataFlight
来源
github.com/DataflightSolutions/claude-plugins/tree/main/plugins/playwright/skills/playwright
覆盖范围
1 已扫描文件 · 463 分析行数
策略版本
不可用

已确认问题的最高严重性

高

有 1 个已确认的安全问题需要处理。

安装上下文

请查看当前 Skill 详情页

本页仅汇总报告证据。Skill 详情页提供 canonical install advisory。

打开当前 Skill 详情页

本报告不会阻止或授权 manifest 或 ZIP。

Most static external-command hits are Markdown or JavaScript backtick false positives. Real risks remain because the skill runs Node and npm commands, executes generated Playwright scripts from /tmp, and saves screenshots to shared temporary paths. I found no evidence of prompt injection, hidden external callbacks, or obfuscated payloads in SKILL.md.

报告位置

最新发布的报告

“最新”仅指报告序列，不代表 artifact 当前有效。

审计证明

无法签发证明

所需的不可变绑定不完整。

人工验证

未进行人工验证

本报告没有人工验证记录。

覆盖范围

1 已扫描文件 · 463 分析行数

有 16 项内容需要查看

局限

本报告不声称进行了运行时或沙箱执行，也不证明不存在副作用。

证据链

证据从来源绑定延伸到安装契约。证据可用于验证，但不是安全保证。

  1. 来源

    已绑定 commit 与路径

  2. 构件

    已绑定内容与 tree hash

  3. 审计

    已完成

  4. 安装契约

    打开 manifest 进行验证

    打开 manifest

观察到的能力

“已观察到”表示本报告记录了支持证据；“未记录”不证明该能力不存在。

包含脚本

可能执行 Skill 随附的代码。

本次审计未记录

网络访问

可能连接外部服务。

在 11 个证据位置观察到

文件系统访问

可能读取或写入本地文件。

在 12 个证据位置观察到

环境变量

可能读取进程环境中的值。

本次审计未记录

外部命令

可能调用 Skill 之外的命令或程序。

在 118 个证据位置观察到

能力复核项 (15)
高
SKILL.md:75-77
Ruby/shell backtick execution
```bash
This bash block runs node run.js against a generated script in /tmp. Executing generated JavaScript from a shared temp location is real local code execution risk.
高
SKILL.md:411-420
Ruby/shell backtick execution
```bash
This inline execution block runs node run.js with JavaScript supplied in the command. It is intentional local code execution and should require user confirmation.
高
SKILL.md:76
Temp directory access
cd ${CLAUDE_PLUGIN_ROOT} && node run.js /tmp/playwright-test-{name}.js
The skill directs generated scripts to /tmp and later runs them with Node. Shared temporary paths can be replaced, collide, or expose generated automation code.
中
SKILL.md:30-32
Ruby/shell backtick execution
```bash
This bash block instructs the agent to run a Node one-liner from the plugin directory to detect dev servers. It is intentional external command execution with fixed arguments.
中
SKILL.md:85-87
Ruby/shell backtick execution
```bash
This bash block tells the user to run npm run setup from the plugin directory. Package scripts can execute local install code, so confirmation is warranted.
中
SKILL.md:439-441
Ruby/shell backtick execution
```bash
This troubleshooting block tells the user to run npm run setup from the plugin directory. Package scripts can execute local install code, so confirmation is warranted.
中
SKILL.md:41
Temp directory access
NEVER write test files to plugin directory. Always use `/tmp/playwright-test-*.js`
The skill directs generated scripts to /tmp and later runs them with Node. Shared temporary paths can be replaced, collide, or expose generated automation code.
中
SKILL.md:45
Temp directory access
// /tmp/playwright-test-{descriptive-name}.js
The skill directs generated scripts to /tmp and later runs them with Node. Shared temporary paths can be replaced, collide, or expose generated automation code.
中
SKILL.md:62
Temp directory access
await page.screenshot({ path: '/tmp/screenshot.png', fullPage: true });
The skill saves browser screenshots under /tmp. Screenshots can contain sensitive page data and predictable temporary paths can be exposed on shared systems.
中
SKILL.md:66
Temp directory access
await page.screenshot({ path: '/tmp/error-screenshot.png' });
The skill saves browser screenshots under /tmp. Screenshots can contain sensitive page data and predictable temporary paths can be exposed on shared systems.
中
SKILL.md:107
Temp directory access
await page.screenshot({ path: '/tmp/page.png', fullPage: true });
The skill saves browser screenshots under /tmp. Screenshots can contain sensitive page data and predictable temporary paths can be exposed on shared systems.
中
SKILL.md:131
Temp directory access
await page.screenshot({ path: `/tmp/${viewport.name.toLowerCase()}.png`, fullPage: true });
The skill saves browser screenshots under /tmp. Screenshots can contain sensitive page data and predictable temporary paths can be exposed on shared systems.
中
SKILL.md:305
Temp directory access
await page.screenshot({ path: '/tmp/iphone12.png' });
The skill saves browser screenshots under /tmp. Screenshots can contain sensitive page data and predictable temporary paths can be exposed on shared systems.
中
SKILL.md:417
Temp directory access
await page.screenshot({ path: '/tmp/quick.png' });
The skill saves browser screenshots under /tmp. Screenshots can contain sensitive page data and predictable temporary paths can be exposed on shared systems.
中
SKILL.md:429
Temp directory access
- **Use /tmp for scripts** - Write to `/tmp/playwright-test-*.js`, never plugin directory
The skill directs generated scripts to /tmp and later runs them with Node. Shared temporary paths can be replaced, collide, or expose generated automation code.

风险问题

已确认的安全问题与仍需审核的项目分开展示。

已确认安全问题 (1)

RISK-001 高
SKILL.md:39-41SKILL.md:75-76
Generated Script Execution From Shared Temporary Directory
The workflow tells the agent to write custom Playwright scripts to /tmp and run them with node run.js. This combines generated code execution with shared temporary storage.
The instructions explicitly require /tmp script creation and a Node wrapper command. The risk is contextual and comes from combining these steps.

补救措施

本次审计记录了建议的修复措施。实施这些措施是维护者的责任。

  1. FIX-001
    高
    Generated scripts run from /tmp
    Use a unique per-run directory with restricted permissions, random filenames, and cleanup before executing generated scripts.
  2. FIX-002
    中
    Local Node and npm commands are required
    Show the exact command and require explicit user confirmation before running setup or automation commands.
  3. FIX-003
    中
    Screenshots are saved in shared temporary paths
    Warn users when pages may contain sensitive data, and store outputs in a private run directory when possible.
  4. FIX-004
    低
    Browser automation can access user-provided URLs
    Prefer localhost or authorized test targets, and avoid production credentials unless the user explicitly approves.

专家证据

不可变主体身份、扫描器元数据、已排除匹配项和源码级证据。

Artifact 主体

Marketplace 提交
7e9e368dc1a370f2040369ebcd0db06d90cb48e5
内容哈希
7486ba5dd52824948ddae6e600855cbeea55fefa99c3ad1a9c806365c0dd6ad1
目录树哈希
f95ba36ccb7e67d4803663392e892133331584e21dcc8f99403b39962c9e4d23
Skill 路径
skills/dataflightsolutions/playwright-browser-automation
审计载荷哈希
c99a20b4624f5c5982d560b590415fbf

分析元数据

审计模型: codex

分析状态: 已完成

范围仅限于已记录的文件、行数、方法和证据；本报告不声称进行了运行时或沙箱执行。

验证与导出

JSON 报告 CITATION.cff SARIF 2.1.0 已签名安装清单 来源

manifest 和 lockfile 将安装 artifact 绑定到加密哈希。该完整性声明独立于安全评估。

审计证明: not_attestable