playwright-browser-automation

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The GitHub tree URL points to a community repository (unknown/third-party owner) that contains code which writes and executes arbitrary local JavaScript and auto-installs dependencies, making it a potentially risky source for malicious payloads; the localhost entries are local development endpoints and not external download sources.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill intentionally executes caller-provided JavaScript locally and runs arbitrary shell commands to install dependencies, weakens browser sandboxing, and includes a database/credential schema — together these create clear local RCE, supply-chain, and sensitive-data exposure risks that could be abused.