playwriter

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). Outsider free text can enter the LLM context via snapshot({ page }) / page observation after the agent navigates to arbitrary web content (e.g., user-supplied URLs or pages on the public web), where the page’s readable text is extracted and fed back into the agent.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's MCP config and install instructions run remote code at runtime via npx/npm (e.g., "npx -y playwriter@latest", which pulls the package from the npm registry such as https://registry.npmjs.org/playwriter), so the skill depends on executing externally fetched code as a required runtime dependency.