playwright-skill
Audited by Socket on Feb 27, 2026
1 alert found:
SecurityThis Playwright skill is a documentation/skill manifest for generating Playwright tests and integrating with a cloud test provider (LambdaTest/TestMu). I found no evidence of obfuscated or intentionally malicious code, no download-and-execute patterns, and no unexpected credential harvesting beyond the normal cloud integration flow (env vars LT_USERNAME and LT_ACCESS_KEY and writing storageState). The primary security considerations are operational: (1) environment variables containing access keys are necessarily transmitted to the cloud provider when using the documented WebSocket connection — ensure users trust that provider and rotate keys appropriately; (2) storageState files (auth.json) contain session data and should be protected from accidental check-in or broad filesystem access; (3) the example page.evaluate snippet appears malformed in the docs and should be corrected to avoid copy-paste errors. Overall this skill is coherent with its stated purpose and does not perform or instruct obviously malicious actions, but users should follow standard secrets-handling practices when using cloud integrations.