playwright-mcp-server
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install and run the Playwright MCP server using
npx @playwright/mcp@latest. This fetches the latest version of the package from the NPM registry, a well-known service. This is a standard installation method for this toolset. - [DYNAMIC_EXECUTION]: The
playwright_evaluatetool allows for the execution of arbitrary JavaScript strings (via theexpressionparameter) within the browser's context. This is a core feature for web automation but provides a mechanism to execute code dynamically at runtime. - [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to navigate to and extract data from external, untrusted websites using tools like
playwright_navigateandplaywright_snapshot. The resulting accessibility trees and page content are processed by the LLM, creating a risk where malicious website content could attempt to override the agent's instructions or behavior. - [COMMAND_EXECUTION]: The skill executes browser automation commands that can interact with the local environment (e.g.,
playwright_screenshotsaving files to a path). While these are controlled through the MCP server, they involve direct system interactions based on agent-generated parameters.
Audit Metadata