teach-web-actions

The snippet is a Playwright runner that dynamically loads and executes a caller-specified JavaScript module (variantPath) with full Node.js privileges, passing it a Playwright page object. While the wrapper contains no explicit malware or exfiltration logic itself, the dynamic require + execution creates an inherently high-impact arbitrary code execution risk if variantPath is not fully trusted. Caller-controlled outDir and persistent profile usage further expand potential impact through filesystem writes and retained browser state.