playwright-mcp
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and installs the
@playwright/mcppackage and required browser binaries (e.g., Chromium) from the official npm registry and Playwright distribution servers during setup. - [COMMAND_EXECUTION]: Utilizes
npmandnpxcommands to install the MCP server, manage browser installations, and execute the automation server in the local environment. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it reads and processes data from external, untrusted websites.
- Ingestion points: External data enters the agent context through
browser_get_text,browser_snapshot, andbrowser_evaluateoperations (SKILL.md). - Boundary markers: The skill instructions do not specify any boundary markers or instructions to the agent to ignore embedded commands within the extracted web content.
- Capability inventory: The skill allows the agent to navigate to any URL, interact with forms, execute arbitrary JavaScript in the browser, and extract page data (SKILL.md, examples.py).
- Sanitization: There is no evidence of sanitization or filtering of the web content before it is processed by the agent.
Audit Metadata