Security risk report for @forgecat/openai_skills_playwright-interactive v0.0.11
Source Integrity
SRC-010Medium
Profile is sourced from OpenAI's official skills repository (https://github.com/openai/skills) with a specific commit hash, reducing supply-chain risk.
Medium risk remains because the profile depends on external npm packages (playwright, electron) and requires downloading binaries; integrity verification relies on npm/package-lock mechanisms.
Content describes a legitimate UI debugging workflow using Playwright and js_repl; no instructions to ignore system prompts, exfiltrate credentials, or hide instructions.
Setup and workflow steps are standard development practices (npm install, browser launch, page navigation); no guidance poisoning or malicious knowledge injection detected.
Preconditions mention sandboxing requirements (--sandbox danger-full-access) as a temporary limitation, not an instruction to bypass security—this is transparent documentation of current constraints.
Details
Evidence
"Persistent browser and Electron interaction through `js_repl` for fast iterative UI debugging."
"For now, run this workflow with sandboxing disabled: start Codex with `--sandbox danger-full-access`... This is a temporary requirement while `js_repl` + Playwright support inside the sandbox is still being completed."
Bootstrap and workflow cells contain only standard Playwright API calls (chromium.launch, browser.newContext, page.goto) with no exfiltration or credential-reading logic.
Permissions
PRM-000Medium
No tools are formally declared, but the skill's core workflow requires `js_repl` — a persistent JavaScript REPL — which enables arbitrary code execution in the agent's environment.
The explicit requirement to disable sandboxing (`danger-full-access`) means the agent operates with full host filesystem and network access, far exceeding what UI debugging alone would require.
The skill also instructs managing dev servers in persistent TTY sessions, compounding the breadth of system access beyond the stated debugging purpose.
Details
Evidence
"run this workflow with sandboxing disabled: start Codex with `--sandbox danger-full-access`"
"js_repl must be enabled for this skill"
"Start or confirm any required dev server in a persistent TTY session"
MCP Risk
Low
No MCP servers are declared in the profile; the skill relies on built-in js_repl and Playwright npm package.
Playwright is a well-known, legitimate open-source browser automation library maintained by Microsoft; no hidden instructions or arbitrary binary execution in tool descriptions.
Setup is explicit and transparent: npm install playwright, then import and use standard Playwright APIs.
Details
Evidence
"MCP servers (untrusted data): (none)"
"npm install playwright" and "node -e \"import('playwright')...\""—standard package installation and verification.
Bootstrap code uses only documented Playwright APIs (chromium.launch, browser.newContext, page.goto).
ForgeCat