playwright-e2e-testing
Fail
Audited by Snyk on Feb 24, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 1.00). The skill explicitly includes plaintext credentials (e.g., "password123") in form-fill examples and instructs the agent to emit commands/requests with those values verbatim, creating an exfiltration risk.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill's workflow explicitly navigates to and interacts with user-supplied URLs (see browser_navigate(url="...") in SKILL.md and triggers like "Run E2E test on [URL]") and then snapshots/reads the page DOM, console messages, and network requests to drive form-filling, waits, and pass/fail decisions, so arbitrary public or user-provided web content could influence agent actions.
Audit Metadata