Playwright MCP Automation

Launch and operate the Playwright MCP server to let agents browse real websites (login, search, checkout, dashboards) through structured tools. Use when the...

This skill appears to do what it says: run a Playwright MCP server and provide guidance for using MCP tools. Before installing or running it, consider: - Supply-chain risk: the script runs `npx @playwright/mcp@latest` (un-pinned). Prefer pinning to a specific vetted version or using an internal mirror. - Network exposure: some snippets instruct `--allowed-hosts=*` and `--host=0.0.0.0` which disable DNS rebinding protections and expose the service. Only use those on isolated hosts or behind strict firewalls/tunnels. - Secrets & profiles: persistent profiles, storage.json, or `--secrets /path/.env` can expose credentials. Keep those files in a secure vault, and avoid reusing an interactive Chrome profile unless you understand the privacy implications. - Privilege and installs: the skill expects Node.js and Playwright browsers; installing system dependencies may require sudo. Run installs on trusted CI/hosts. - Operational best practice: review the upstream Playwright MCP repo and pin versions, restrict allowed hosts, and firewall or auth-protect any exposed MCP HTTP endpoint. If you need higher assurance, ask the author for a reproducible install spec that pins package versions or provide more provenance for the package source.

Type: OpenClaw Skill Name: playwright-mcp-automation Version: 1.0.0 The skill bundle is classified as suspicious due to several significant vulnerabilities and risky capabilities. The `scripts/start_playwright_mcp.sh` script contains a shell injection vulnerability via the `${EXTRA} "$@"` expansion, allowing an attacker (e.g., via prompt injection to the agent) to pass arbitrary arguments to `npx @playwright/mcp@latest`, potentially leading to arbitrary command execution. Additionally, `references/setup.md` instructs the agent to run `sudo npx playwright install-deps chromium`, which is a privilege escalation risk if the agent has `sudo` access. The `browser_run_code` tool, documented in `references/tools.md`, allows arbitrary JavaScript execution within the browser context, which could be exploited via prompt injection to perform actions like data exfiltration from browsed websites. While the skill's purpose is legitimate browser automation, these vulnerabilities and powerful primitives pose a high risk of exploitation.