playwright-skill

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill includes hard-coded plaintext credentials in example test scripts (e.g., 'password123'), which instructs the LLM to generate output containing secret values verbatim even though env-var alternatives are suggested elsewhere.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The package includes high-risk features: an executor that writes and require()s user-supplied code (RCE), automatic npm installation (supply‑chain risk / lifecycle scripts), environment-driven header injection for requests (possible credential/token leakage), and explicit local-server probing — all of which can be abused for data exfiltration or backdoor behavior.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s required runtime workflow executes Playwright automation code (including page.goto(TARGET_URL) and extraction like screenshots/page title) that is effectively controlled by the outsider-supplied “what to test/automate” request and any user-provided URL, so the agent can be induced to read and ingest free text from attacker-controlled web pages at runtime.