playwright-mcp

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill's example and tool schema show the agent emitting actions that include plaintext input values (e.g., browser_type with "text" for a password), which would require the LLM to include secret credential values verbatim in its output.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). SKILL.md describes using Playwright MCP to browser_navigate to arbitrary URLs and then extract page text/snapshots at runtime (outsider web content becomes LLM-readable via navigation/extraction tool outputs), enabling indirect prompt injection.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill instructs runtime installation/execution via npx (e.g., "npx @playwright/mcp" and "npx playwright install chromium"), which fetches and executes code from the npm package referenced at https://www.npmjs.com/package/@playwright/mcp, so the skill depends on external code executed at runtime.