playwright-stealth-setup

SUSPICIOUS: The skill is internally consistent and uses official CloakHQ/PyPI/GitHub distribution paths, so it is not strong evidence of malware. However, it installs a stealth-focused browser toolchain, optionally routes auth through vendor login, clears macOS quarantine, and documents a disabled Chromium sandbox, making the overall security risk medium even though the purpose/capability alignment is coherent.

No direct malicious payload (e.g., exfiltration/backdoor) is evidenced in the provided excerpt because it appears to be documentation/troubleshooting rather than the underlying implementation. However, the fragment describes a security-critical automation posture: Chromium sandbox is stated as disabled by default, and the tool uses persisted identity data containing decryptable session cookies and saved passwords. Combined with downloading/installing and executing Chromium binaries, this creates a substantially elevated security risk, particularly under hostile browsing/exploit conditions and if identity directories are mismanaged. Verify the full implementation for (1) how/when --no-sandbox is applied, (2) whether downloaded binaries are integrity-verified, and (3) how credential-bearing profiles are protected and scoped.