playwright-skill

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly asks for or accepts user-provided/external URLs (SKILL.md Step 1: "If no servers found: Ask for URL"), and its example workflows and helpers (e.g., scripts using page.goto(TARGET_URL), the "Check for Broken Links" script that fetches link hrefs, and helpers.extractTexts/extractTableData in lib/helpers.js) fetch and parse arbitrary public web pages—untrusted third-party content that the agent reads and can drive follow-up actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). Yes — run.js may invoke npm/npx at runtime (executes "npm install" and "npx playwright install chromium"), which downloads and executes remote packages/binaries from the npm registry (e.g. https://registry.npmjs.org/) and Playwright's download CDN (e.g. playwright binary CDN such as https://playwright.azureedge.net/) required for the skill to run, so remote code is fetched and executed.