Playwright Cli

Playwright CLI 自动化工具 - 浏览器自动化测试和网页交互。通过 CLI 命令控制浏览器、截图、填表、点击、执行代码等操作。支持多浏览器、会话管理、网络拦截、视频录制等功能。

This skill's instructions are coherent with a Playwright CLI tool but the package metadata omits key facts and the runtime actions are powerful: - The SKILL.md requires npm/node and suggests running 'npm install -g', but the skill metadata doesn't declare these. Expect the install to write to disk and possibly require elevated permissions. - The CLI can read cookies, localStorage, saved states, upload files, intercept network requests, and execute arbitrary code (run-code), which could expose sensitive site data or local files. - Before installing: verify the source and npm package owner, prefer pinned versions (avoid '@latest'), and consider installing in a sandbox/container or using a non-global, audited install. - If you allow an agent to run this skill autonomously, restrict it from running on machines with sensitive data and avoid granting it broad filesystem or network access. - If you need this capability, ask the publisher to update metadata to declare required binaries (node, npm), environment variables, and to provide a trusted install mechanism or checksum; without that, treat the skill as untrusted.

Type: OpenClaw Skill Name: playwright-cli-tool Version: 1.0.0 The skill bundle describes a browser automation tool with high-risk capabilities, including arbitrary JavaScript execution (`run-code`), cookie and local storage extraction (`cookie-list`, `localstorage-get`), and the ability to attach to existing browser sessions. It also directs the installation of a non-standard npm package `@playwright/cli` (the official package is typically `playwright` or `@playwright/test`). While these features are technically aligned with the stated purpose of browser automation, they provide a significant attack surface for data exfiltration and unauthorized remote control, warranting a suspicious classification.