playwright-skill
Warn
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The run.js script implements a universal execution pattern that reads JavaScript code from command-line arguments or standard input, writes it to a temporary file (.temp-execution-*.js) within the skill directory, and then executes it using require(). This allows for the execution of arbitrary code within the agent's runtime environment.\n- [COMMAND_EXECUTION]: The skill's primary workflow, as described in SKILL.md, involves the agent generating custom JavaScript automation scripts and executing them through the run.js wrapper using shell commands.\n- [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection because it is designed to navigate to and extract information from arbitrary websites.\n
- Ingestion points: Web content is retrieved and processed through Playwright commands and helper functions like extractTexts and extractTableData in lib/helpers.js.\n
- Boundary markers: The instructions do not define clear boundaries or 'ignore' directives for the agent when processing scraped content.\n
- Capability inventory: The agent has the ability to execute shell commands (via run.js), perform network operations, and write files to the system (e.g., screenshots).\n
- Sanitization: The skill lacks mechanisms to sanitize or validate data fetched from external URLs before it is processed by the agent.\n- [EXTERNAL_DOWNLOADS]: The skill automates the download and installation of the Playwright library and Chromium browser binaries from official sources during the setup phase and execution via the run.js script.
Audit Metadata