playwright-skill-v2

Warn

Audited by Socket on Mar 28, 2026

1 alert found:

Anomaly
AnomalyLOW
src/inject.ts

This module is primarily a Playwright automation helper that performs non-trivial, privacy-invasive instrumentation by monkey-patching console, fetch, and XMLHttpRequest in a live browser session and recording outputs into window global variables without redaction. While it does not itself show exfiltration or overt malware behaviors in this fragment, the injected capability could capture secrets (e.g., tokens logged to console, URLs/parameters) and therefore warrants review of downstream handling, storage, and transmission of window.__capturedConsole/__capturedRequests.

Confidence: 65%Severity: 60%
Audit Metadata
Analyzed At
Mar 28, 2026, 09:20 PM
Package URL
pkg:socket/skills-sh/willmarple%2Fplaywright-skill%2Fplaywright-skill-v2%2F@dacc2ca55afb70d2d990a11b7df7e3ffdf0c3c3f
Security Audit — socket — playwright-skill-v2