playwright-skill

Warn

Audited by Runlayer on Feb 21, 2026

Risk Level: MEDIUM
Scan Summary
Max Score
78%
Files
5
Flagged
5
Chunks
8
Flagged Files (5)
API_REFERENCE.mdHIGH
78.3%

Malicious tool definition detected

Tool: API_REFERENCE.md [1/2] Description: # Playwright Skill - Complete API Reference This document contains the comprehensive Playwright API reference and advanced patterns.

Tool: API_REFERENCE.md [2/2] Description: { ...route.request().headers(), 'X-Custom-Header': 'value' }; route.continue({ headers }); }); // Block resources await page.route('**/*.{png,jpg,jpeg,gif}', route => route.abort()); ``` ### Custom Headers via Environment Variables The skill supports automatic header injection via environment variables: ```bash # Single header (simple) PW_HEADER_NAME=X-Automated-By PW_HEADER_VALUE=playwright-skill # Multiple headers (JSON) PW_EXTRA_HEADERS='{"X-Automated

SKILL.mdHIGH
78.3%

Malicious tool definition detected

Tool: SKILL.md [1/2] Description: --- name: playwright-skill description: Complete browser automation with Playwright.

Tool: SKILL.md [2/2] Description: console.log('Screenshot saved'); await browser.close(); " ``` **When to use inline vs files:** - **Inline**: Quick one-off tasks (screenshot, check if element exists, get page title) - **Files**: Complex tests, responsive design checks, anything user might want to re-run ## Available Helpers Optional utility functions in `lib/helpers.js`: ```javascript const helpers = require('./lib/helpers'); // Detect running dev servers (CRITICAL - use this first!) const serv

lib/helpers.jsHIGH
78.3%

Malicious tool definition detected

Tool: lib/helpers.js [1/2] Description: // playwright-helpers.js // Reusable utility functions for Playwright automation const { chromium, firefox, webkit } = require('playwright'); /** * Parse extra HTTP headers from environment variables.

Tool: lib/helpers.js [2/2]

package.jsonHIGH
78.3%

Malicious tool definition detected

Tool: package.json Description: { "name": "playwright-skill", "version": "4.1.0", "description": "General-purpose browser automation with Playwright for Claude Code with auto-detection and smart test management", "author": "lackeyjb", "main": "run.js", "scripts": { "setup": "npm install && npx playwright install chromium", "install-all-browsers": "npx playwright install chromium firefox webkit" }, "keywords": [ "playwright",

run.jsHIGH
78.3%

Malicious tool definition detected

Tool: run.js Description: #!/usr/bin/env node /** * Universal Playwright Executor for Claude Code * * Executes Playwright automation code from: * - File path: node run.js script.js * - Inline code: node run.js 'await page.goto("...")' * - Stdin: cat script.js | node run.js * * Ensures proper module resolution by running from skill directory.

Audit Metadata
Max File Score
78%
Classification
UNKNOWN_SERVER
Files Scanned
5
Files Flagged
5
Chunks Analyzed
8
Analyzed
Feb 21, 2026, 04:39 AM
Security Audit — runlayer — playwright-skill