playwright-skill
Warn
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [DYNAMIC_EXECUTION]: The run.js script implements a mechanism to execute arbitrary JavaScript code by wrapping input into a template, writing it to a temporary file, and loading it via require(). This allows for runtime execution of dynamically generated scripts.
- [INDIRECT_PROMPT_INJECTION]: The skill includes helper functions like extractTexts and extractTableData in lib/helpers.js that ingest data from external web pages. As there are no explicit sanitization steps or boundary markers described, this creates an attack surface where a malicious website could supply instructions to the agent.
- Ingestion points: extractTexts and extractTableData in lib/helpers.js.
- Boundary markers: Not present.
- Capability inventory: Shell command execution via execSync in run.js and full browser automation capabilities.
- Sanitization: Not present for extracted data.
- [COMMAND_EXECUTION]: The skill uses execSync in run.js to manage the environment and install dependencies. The primary purpose of the skill is to control browser processes via Playwright.
- [DATA_EXFILTRATION]: The skill supports passing custom HTTP headers via environment variables such as PW_EXTRA_HEADERS in lib/helpers.js. If an agent is induced to include sensitive data in these headers, they could be sent to an external endpoint during browser automation.
Audit Metadata