技能 playwright-stealth-verify
📦
playwright-stealth-verify
內容修訂 r1 中風險 ⚙️ 外部命令🌐 網路存取
Verify Automated Browser Fingerprints
Automated browsers can expose inconsistent fingerprints that weaken test reliability. This skill measures those inconsistencies with liarjs and explains the failing checks.
支援: Claude Codex Code(CC)
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "playwright-stealth-verify" from https://skillstore.io/skills/liarjsdev-playwright-stealth-verify.md and its manifest at https://skillstore.io/api/skills/liarjsdev-playwright-stealth-verify/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「playwright-stealth-verify」。 Check this Playwright Page offline and explain the result.
預期結果:
- Overall result: weak fingerprint consistency.
- The webdriver and headless user-agent checks failed.
- No external network request was made.
- Review launch settings before setting a test threshold.
正在使用「playwright-stealth-verify」。 Review the browser on my confirmed local CDP endpoint.
預期結果:
The browser is reachable and the client signals are mostly coherent. Worker identity differs from the main thread, indicating a partial override.
正在使用「playwright-stealth-verify」。 Suggest a continuous integration assertion from this stable baseline.
預期結果:
Require a score of at least 85 and fail when webdriver, native integrity, or worker consistency reports a bad status.
安全審計
中風險v1 • 2026/8/8 開啟版本化報告
Most static findings confuse Markdown backticks with shell execution or flag documentation as reconnaissance. Four findings are confirmed because the skill runs external packages or sends fingerprint data to liarjs.dev. Contextual review also identified CDP session access and browser detection-evasion assessment as dual-use risks.
1
已掃描檔案
103
分析行數
5
複核項目
0
已忽略的誤報
已確認的安全問題 (2)
中
Active Browser Session Attachment
The workflow attaches through CDP to a running browser. A mistaken endpoint can expose authenticated pages, cookies, and session data to executed tooling.
The instructions explicitly launch or attach to a CDP endpoint and acknowledge that the session belongs to the user.
中
Browser Detection-Evasion Assessment
The skill measures whether automation resembles a normal browser and evaluates stealth-plugin effects. Results can help tune automation against detection controls.
The stated purpose and result guidance directly assess automation indicators, although the document provides measurements rather than evasions.
能力複核項目 (5)
這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。
中
Ruby/shell backtick execution
```bash
The fenced block instructs npm to install a community package. Installation changes the project and can execute package lifecycle scripts.
中
Ruby/shell backtick execution
```bash
The Bash example uses npx to download and execute liarjs while attaching to a CDP endpoint. This is real external command execution.
中
Ruby/shell backtick execution
```bash
The Bash block launches Chrome with remote debugging and executes liarjs through npx. Both commands affect local processes and browser state.
中
Ruby/shell backtick execution
default (`npx liarjs@0.3`, which launches its own throwaway profile in a temp directory and deletes
The prose recommends running npx liarjs, which downloads and executes an external package. User confirmation reduces but does not remove this risk.
中
Hardcoded URL
- Without `--offline`, the browser under test fetches `https://liarjs.dev/api/net.json` to learn wha
Online mode sends a request to liarjs.dev that reveals IP, ASN, TLS, headers, and ClientHello attributes. This discloses fingerprint data externally.
風險因素
⚙️ 外部命令 (32)
SKILL.md:10 SKILL.md:19 SKILL.md:20 SKILL.md:23-33 SKILL.md:33-35 SKILL.md:35 SKILL.md:36 SKILL.md:40-42 SKILL.md:42-46 SKILL.md:46-48 SKILL.md:48-53 SKILL.md:53-56 SKILL.md:56-59 SKILL.md:59-67 SKILL.md:67 SKILL.md:68 SKILL.md:69 SKILL.md:70-71 SKILL.md:71 SKILL.md:72-73 SKILL.md:73 SKILL.md:74-76 SKILL.md:76 SKILL.md:79 SKILL.md:83-85 SKILL.md:85 SKILL.md:87-90 SKILL.md:90 SKILL.md:97-98 SKILL.md:98 SKILL.md:99-100 SKILL.md:100
審計單位: codex
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/liarjsdev-playwright-stealth-verify/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/liarjsdev-playwright-stealth-verify?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/liarjsdev-playwright-stealth-verify?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/liarjsdev-playwright-stealth-verify/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/liarjsdev-playwright-stealth-verify.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
liarjsdev. (2026). playwright-stealth-verify security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/liarjsdev-playwright-stealth-verify/audits/1BibTeX 引用
@techreport{liarjsdev-liarjsdev-playwright-stealth-verify-2026,
author = {liarjsdev},
title = {playwright-stealth-verify security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/liarjsdev-playwright-stealth-verify/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "playwright-stealth-verify security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "liarjsdev"
date-released: "2026-08-08"
url: "https://skillstore.io/skills/liarjsdev-playwright-stealth-verify/audits/1"
identifiers:
- type: other
value: "skillstore:liarjsdev-playwright-stealth-verify:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據 證據置信度: 中 55
架構
85
可維護性
87
內容
65
社群
83
規範符合度
你可以打造什麼
Validate Test Browser Configuration
Measure fingerprint consistency before automated browser tests run in continuous integration.
Audit a Custom Chromium Build
Attach to a local CDP endpoint and identify inconsistent browser identity signals.
Review Automation Fingerprint Regressions
Compare failed check identifiers after launch flags, plugins, or proxies change.
試試這些提示
Run an Offline Check
Check my Playwright browser fingerprint offline. Explain the score and list the failed checks without changing the browser.
Inspect an Existing Page
Use liarjs checkPage with my existing Page object. Summarize fingerprint inconsistencies and suggest test assertions.
Audit a Local CDP Browser
After I confirm ownership, audit the browser at my local CDP endpoint. Do not visit third-party pages or modify the profile.
Design a Regression Gate
Analyze my baseline and current fingerprint results. Propose score and check-level gates that detect meaningful regressions while limiting false failures.
最佳實務
- Use offline mode when external network observation is unnecessary.
- Confirm CDP endpoint ownership and use an isolated browser profile.
- Pin liarjs to an exact reviewed version in the project lockfile.
避免
- Do not attach to an unknown CDP endpoint or an active personal browsing profile.
- Do not send fingerprint data to an external endpoint without consent.
- Do not treat a high score as permission to bypass third-party access controls.
常見問題
Which browser automation tools are supported?
The skill supports Playwright, Puppeteer, Selenium, and compatible CDP-driven browsers.
Does the skill modify the browser?
No. It measures browser and network signals but does not install stealth patches or profiles.
Can it run without an external request?
Yes. Offline mode runs JavaScript-layer checks without contacting the network observation endpoint.
What does online mode disclose?
It can disclose IP, ASN, HTTP, TLS, ClientHello, and header attributes to the configured endpoint.
Does a high score guarantee detection avoidance?
No. The score measures known consistency checks and cannot predict every external detection system.
What safety step is required for CDP?
Confirm endpoint ownership and use a browser profile without sensitive accounts or pages.