playwright-skill

This file is not a standalone stealer/backdoor; it is a high-privilege universal JavaScript executor. It executes attacker-controlled code in-process via require(tempFile) after writing it to disk, and it can perform runtime 'npm install' and 'npx playwright install chromium' when Playwright is missing. That combination creates substantial security and supply-chain risk in any context where the executed input or runtime environment is not fully trusted. No explicit malicious payload is present in the shown code, but the capability to run arbitrary code is itself a major danger signal.