browsing-with-playwright
Warn
Audited by Gen Agent Trust Hub on Mar 9, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
scripts/start-server.shscript utilizesnpxto download and execute the@playwright/mcp@latestpackage from the NPM registry at runtime. - [REMOTE_CODE_EXECUTION]: The
browser_run_codeandbrowser_evaluatetools (documented inreferences/playwright-tools.md) allow for the execution of arbitrary JavaScript snippets within the browser context. - [DATA_EXFILTRATION]: The
browser_file_uploadtool accepts absolute file paths, which could potentially be used to access and upload sensitive local files if the agent is directed to do so by malicious input. - [COMMAND_EXECUTION]: The
scripts/mcp-client.pyscript employssubprocess.Popenwithshell=Truewhen using the stdio transport, which is a common pattern for executing shell commands. - [PROMPT_INJECTION]: The skill's primary function involves processing data from external websites, creating a surface for indirect prompt injection. 1. Ingestion points: Web content retrieved via
browser_navigate. 2. Boundary markers: None identified in the provided files. 3. Capability inventory: Arbitrary JS execution (browser_run_code), file uploads (browser_file_upload), and shell command execution in the client script. 4. Sanitization: No explicit sanitization of web content before processing is evident in the provided scripts.
Audit Metadata