playwright-skill

Warn

Audited by Socket on Feb 27, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

This Playwright skill is a documentation/skill manifest for generating Playwright tests and integrating with a cloud test provider (LambdaTest/TestMu). I found no evidence of obfuscated or intentionally malicious code, no download-and-execute patterns, and no unexpected credential harvesting beyond the normal cloud integration flow (env vars LT_USERNAME and LT_ACCESS_KEY and writing storageState). The primary security considerations are operational: (1) environment variables containing access keys are necessarily transmitted to the cloud provider when using the documented WebSocket connection — ensure users trust that provider and rotate keys appropriately; (2) storageState files (auth.json) contain session data and should be protected from accidental check-in or broad filesystem access; (3) the example page.evaluate snippet appears malformed in the docs and should be corrected to avoid copy-paste errors. Overall this skill is coherent with its stated purpose and does not perform or instruct obviously malicious actions, but users should follow standard secrets-handling practices when using cloud integrations.

Confidence: 75%Severity: 75%
Audit Metadata
Analyzed At
Feb 27, 2026, 11:14 AM
Package URL
pkg:socket/skills-sh/LambdaTest%2Fagent-skills%2Fplaywright-skill%2F@ed252905aba527560584a6a540aaa4bc0aca55d9