playwright-skill

This fragment implements an “arbitrary code execution” style runner: it takes user-supplied JavaScript (file path, inline argv, or stdin), writes it to a temporary .js file, and executes it via require(). That is a significant security risk (RCE) in any scenario where inputs are not fully trusted. Additionally, it can install Playwright via npm/npx when missing, increasing supply-chain/download risk. No direct evidence of credential theft, cryptomining, or network exfiltration exists in this fragment alone; however, the execution mechanism could enable such behavior from the provided code.