Browser automation via remote Playwright WebSocket server for screenshots, PDFs and testing.
Security Analysis
high confidenceThe skill's files and runtime instructions are consistent with a remote Playwright WebSocket-based screenshot/PDF/test runner: required Node and PLAYWRIGHT_WS are appropriate and the scripts do what the description says, with only minor documentation/env-var inconsistencies to fix.
Name/description match the actual code: scripts connect to a Playwright WebSocket server and implement screenshots, PDF export, and a test runner. Required binary (node) and the primary environment variable (PLAYWRIGHT_WS) are appropriate for this functionality.
SKILL.md and scripts stay within the described purpose (connect to remote Playwright server, navigate pages, save screenshots/PDFs, run tests). The test-runner script uses execSync to invoke 'npx playwright test' (expected for running tests). There is no instruction to read unrelated system files or exfiltrate arbitrary data in the codebase, but the scripts do send URLs and page interactions to the remote server (expected given purpose).
This is an instruction-only skill (no platform install spec). The repository includes a package.json and instructs 'npm install' in SKILL.md — that's normal because Playwright is a substantial dependency. There are packaging scripts that use child_process.execSync to create zip files (packaging-time behavior, not runtime), which is expected.
The declared required env var (PLAYWRIGHT_WS) is appropriate as the primary credential. There is a minor inconsistency: some documentation (README and scripts/test-runner.js) reference PLAYWRIGHT_SERVER (and derive a WS endpoint from it) in addition to PLAYWRIGHT_WS. The additional PLAYWRIGHT_SERVER usage is not declared in the metadata and should be clarified.
The skill does not request elevated privileges, does not set always:true, and does not modify other skills' config. Autonomous invocation is allowed by default but not combined with other concerning flags.
Guidance
This skill appears to do exactly what it says: run Playwright over a remote WebSocket to capture screenshots, generate PDFs, and run tests. Before installing, consider the following: - Environment variables: confirm which variable you will use — SKILL.md expects PLAYWRIGHT_WS but README/test-runner mention PLAYWRIGHT_SERVER; pick one and set it correctly. The skill will connect to whatever WebSocket you provide. - Trust the remote server: the Playwright server you point at will see the URLs you load and can interact with page content. Only use servers you control or fully trust; do not point PLAYWRIGHT_WS at unknown public endpoints. - Dependencies and install: running 'npm install' will pull Playwright (a large package). Install in an isolated environment if you are cautious. - Test runner behavior: the test-runner executes 'npx playwright test' (child process). That will run any tests included in the repo; review included tests and CI scripts if you want to be sure nothing unexpected runs. If you want higher assurance, run the scripts locally in a sandboxed environment (or inspect and run unit tests) and correct the README/SKILL.md mismatch for PLAYWRIGHT_WS vs PLAYWRIGHT_SERVER.
Latest Release
v1.0.0
Initial release
Popular Skills
Published by @first-it-consulting on ClawHub
