vscode-playwright
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- Command Execution: The skill executes the VS Code CLI (
codeorcode-insiders) usingsubprocess.Popento host a local web server for capturing screenshots. This is a core component of the automated workflow. - External Downloads: The VS Code CLI's
serve-webcommand automatically fetches the VS Code Server environment from Microsoft's servers to run the web-based editor. This is documented behavior of the official tool. - Path Traversal Protection: The automation script implements a specialized
contained_pathcheck to ensure that generated screenshots are only written within the intended output directory, preventing potential path traversal issues and unauthorized file writes via symlinks. - Local Network Usage: The skill communicates with the local VS Code instance over a 127.0.0.1 loopback address to verify server readiness and drive the screenshot process via Playwright.
Audit Metadata