agentic-browser-testing

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill’s runtime path uses Playwright MCP browser_snapshot to capture the accessibility tree from the target web app, which is outsider-authored free text (the app’s UI/ARIA labels) that the agent then ingests into the LLM context for decision-making.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The .mcp.json runtime command uses npx to fetch-and-execute the remote package "@playwright/mcp@latest" (via "npx @playwright/mcp@latest ..."), which pulls remote code at agent runtime and is a required dependency for running the MCP server.