playwright-skill
Fail
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: HIGHCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONOBFUSCATION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides the agent with the ability to execute arbitrary Node.js code on the host machine. The
run.jsscript allows code to be passed via file path, command-line arguments, or standard input, and executes it with the user's full privileges.\n- [DYNAMIC_EXECUTION]: The skill uses dynamic code generation and execution. Therun.jsexecutor takes a code string, wraps it in an asynchronous execution template, writes it to a temporary file, and then loads that file using the Node.jsrequire()function.\n- [INDIRECT_PROMPT_INJECTION]: The skill is highly vulnerable to indirect prompt injection because it interacts with untrusted external web content.\n - Ingestion points: Browser navigation is performed in
SKILL.mdandlib/helpers.jsto URLs that may be attacker-controlled.\n - Boundary markers: The instructions do not contain any directives or markers telling the agent to treat page content as data and ignore any embedded instructions.\n
- Capability inventory: The skill provides full local code execution, network access, and filesystem access via the
run.jsscript and Playwright libraries.\n - Sanitization: No validation or sanitization is performed on the data retrieved from external web pages before it is processed by the agent.\n- [OBFUSCATION]: The
lib/helpers.jsfile contains minor obfuscation where credential-related selectors are constructed using string concatenation (e.g., 'pass' + 'word') to avoid simple detection by static analysis tools.
Recommendations
- AI detected serious security threats
Audit Metadata