playwright-skill-v2
Warn
Audited by Socket on Mar 28, 2026
1 alert found:
AnomalyAnomalysrc/inject.ts
LOWAnomalyLOW
src/inject.ts
This module is primarily a Playwright automation helper that performs non-trivial, privacy-invasive instrumentation by monkey-patching console, fetch, and XMLHttpRequest in a live browser session and recording outputs into window global variables without redaction. While it does not itself show exfiltration or overt malware behaviors in this fragment, the injected capability could capture secrets (e.g., tokens logged to console, URLs/parameters) and therefore warrants review of downstream handling, storage, and transmission of window.__capturedConsole/__capturedRequests.
Confidence: 65%Severity: 60%
Audit Metadata