Agent Economy ReportAgent Economy ReportCAUTION version 1.0.0 · audited 2026-09-17
This skill is a setup guide and example for Playwright MCP, a third-party browser automation server. It tells the agent how to install and start that software and shows how to ask it to open web pages, click, type, extract data, and save screenshots or recordings. It does not contain hidden network calls, credential theft, wallet redirection, or persistence. The main review points are that it installs a mutable package from npm, grants powerful browser control, can execute JavaScript inside visited pages, and can write browser output files. Because those abilities are broad and the package's own card lists related risks, this is rated CAUTION, not SAFE.
| Declared purpose | Browser automation via Playwright MCP server. Navigate websites, click elements, fill forms, extract data, take screenshots, and perform full browser automation workflows. |
| Observed behavior | The package is a guide and examples for installing and using @playwright/mcp. SKILL.md instructs npm/npx commands and describes MCP browser tools such as navigate, click, type, evaluate JavaScript, choose file, and screenshot. examples.py imports subprocess but only prints simulated MCP calls. The package itself does not perform browser automation or exfiltrate data. |
| Verdict, rules only | CAUTION · runs subprocesses or eval/exec |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| browser | needed | Uses Playwright MCP to control a browser: navigate, click, type, select, extract text, evaluate JavaScript, snapshot, close, upload files, press keys (SKILL.md lines 78-89). |
| network | needed | Browser automation makes outbound web requests to visited sites; examples use https://example.com (SKILL.md line 119; examples.py line 44). |
| shell | needed | Setup and start commands are bash/npm/npx (SKILL.md lines 13-17, 27-28). |
| install_packages | needed | The guide installs @playwright/mcp as a global npm package or runs it with npx (SKILL.md lines 14 and 16). |
| filesystem_write | needed | Playwright output options can write screenshots, traces, and videos under an output directory (SKILL.md lines 110-112). |
| filesystem_read | needed | The browser_choose_file tool uploads a local file (SKILL.md line 88), which implies reading selected local files for upload. |
| severity | finding |
|---|---|
| medium | Global install of mutable npm package This command installs the latest @playwright/mcp package globally from npm. The package is third-party and mutable, so the code an agent runs can change between installs. skill-card.md line 24 acknowledges this risk. SKILL.md:14 npm install -g @playwright/mcp |
| medium | Download-and-run via npx Running with npx fetches and executes the package outside a version-pinned install. This is another code-execution path from the npm registry. SKILL.md:16 npx @playwright/mcp |
| medium | Transport validation can be disabled The guide documents --ignore-https-errors, which can make browser traffic accept invalid TLS certificates. skill-card.md line 28 warns about this; it should stay off outside controlled testing. SKILL.md:43 npx @playwright/mcp --ignore-https-errors |
| medium | JavaScript execution in visited pages browser_evaluate runs arbitrary JavaScript in the page context. This is useful for extraction but broad; if the browser has session data, the script operates with the page's privileges. SKILL.md:56 # - browser_evaluate: Run JavaScript |
| low | Local file upload capability The MCP tool reference includes choosing a local file for upload. That creates a path for selected local files to leave the machine when used. SKILL.md:88 | `browser_choose_file` | Upload file | |
| low | Browser artifacts written to disk The output options can save screenshots, traces, and videos under an output directory. Saved content may contain page data or sensitive information; skill-card.md line 32 notes this. SKILL.md:110 --output-dir ./playwright-output |
| low | Login examples type credentials into forms The example demonstrates filling a password field. This is expected for browser automation, but an agent using this skill may handle real credentials in visited sites. SKILL.md:121 browser_type: { selector: "#password", text: "pass" } |
| info | Subprocess module imported but not called examples.py imports subprocess, but the file only prints simulated MCP calls. No subprocess execution, shell pipeline, or hidden command was found in this file. examples.py:8 import subprocess |
| info | Publisher acknowledges supply-chain risk The package's own risk section states that it asks users to run mutable npm packages for browser control. skill-card.md:24 Risk: The skill asks users to run mutable npm packages for a powerful browser-control MCP server. |
| info | Publisher acknowledges navigation/TLS risk The card warns that browser automation can reach untrusted sites or weaken transport validation if misconfigured. skill-card.md:28 Risk: Browser automation can navigate to untrusted sites or weaken transport validation when misconfigured. |
| info | Publisher acknowledges sensitive artifacts risk The card warns that saved artifacts and form entries may contain sensitive information. skill-card.md:32 Risk: Saved screenshots, traces, videos, and form entries can contain sensitive information. |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:9 |
| example.com | not in the service index | SKILL.md:119 |
| modelcontextprotocol.io | not in the service index | SKILL.md:164 |
| playwright.dev | not in the service index | SKILL.md:163 |
| www.npmjs.com | not in the service index | SKILL.md:165 |
| Binaries invoked | bash, npm, npx, python, python3 |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 1 |
| base64 blobs | 0 |
| File writes | 0 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 165 | 179b2b6335aa2e3c… |
_meta.json | 6 | 6bc5c96591868877… |
examples.py | 114 | a3cf829604177ba8… |
skill-card.md | 60 | c3c29943faa70f4b… |
For agents
JSON: https://agenteconomy.report/k/playwright-mcp.audit.json · badge: https://agenteconomy.report/k/playwright-mcp.audited.svg ·
skill rating: /k/playwright-mcp · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).