playwright-cli
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates browser automation through the
playwright-clitool. It utilizesbunxto execute the@playwright/mcppackage, enabling local command execution to control browser instances. - [DYNAMIC_EXECUTION]: The
run-codecommand allows for the execution of arbitrary JavaScript within the browser context. This feature is documented for handling advanced scenarios such as geolocation manipulation, permission granting, and complex web workflows. - [INDIRECT_PROMPT_INJECTION]: The skill interacts with external websites, which serves as an ingestion point for untrusted data. This creates a potential surface for indirect prompt injection attacks.
- Ingestion points: Any web page content navigated to via
openorgotocommands. - Capability inventory: The agent can perform interactive browser actions, write files to disk (screenshots, PDFs, storage state), and execute custom JavaScript.
- Boundary markers: None are explicitly defined in the instructions to separate web content from agent instructions.
- Sanitization: There is no built-in mechanism mentioned for sanitizing or filtering data extracted from web pages before processing.
Audit Metadata