playwright-cli

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes concrete examples that set and retrieve secrets verbatim (e.g., cookie-set session_id abc123, fill ... "password123", and TOKEN=$(playwright-cli --raw cookie-get session_id)), which forces the agent to handle and potentially emit secret values directly.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The documentation exposes several powerful features (arbitrary JS execution via eval/run-code, cookie/storage save/load, clipboard read, tracing with full network bodies, and CDP attach) that can be abused to read and exfiltrate sensitive credentials/state and enable remote access to a browser session.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the required workflow, playwright-cli find/snapshot/eval operate on the contents of the loaded web page (DOM text and snapshot output) which can include outsider-authored free text from attacker-controlled pages once the workflow navigates/attaches and then ingests it into the LLM via snapshot/find context at runtime.