playwright-cli

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The CLI exposes commands that take and emit sensitive values directly (e.g., cookie-set , localstorage-set , embedding auth state files), so an agent instructed to generate those commands or copy values would need to include secrets verbatim, creating exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's documentation (SKILL.md and advanced-workflows.md) explicitly instructs the agent to open/goto arbitrary public URLs and use run-code to scrape/evaluate web pages (e.g., "playwright-cli open https://...", multi-page scraping and "playwright-cli run-code" examples that visit example.com, news/blog sites, feeds), so the agent will fetch and act on untrusted third-party web content that could contain instructions influencing subsequent actions.