playwright-snapshots

No direct malware, credential theft, or obfuscation is visible. The `visual-update` pull-request workflow presents a significant CI supply-chain risk because it executes PR-controlled code and then pushes changes using the checkout's available credentials. Restrict who can apply the trigger label, use least-privilege token permissions, and avoid persisting write credentials during untrusted code execution.