registry  /  ttj-skills-playwright  /  1.1.0

ttj-skills-playwright@1.1.0

Drive an existing Chrome over CDP (Playwright core) with one-shot commands — eval, goto, click, type, wait, tabs, screenshot — plus page element visualization and crawl-target analysis. Skill for Claude Code & Codex.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. The postinstall hook installs a package-owned AI-agent skill into global Claude Code and Codex skill directories. The installed skill can lead agents to operate an existing Chrome instance through the package CLI, including page-JavaScript evaluation.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm install executes postinstall; later agent or user invocation activates browser commands.
Impact
Unconsented global agent-extension setup broadens agent behavior and enables powerful browser control, but no concrete theft, remote execution, or destructive chain is confirmed.
Mechanism
First-party global agent-skill installation plus CDP browser automation.
Rationale
The lifecycle hook makes unprompted first-party global AI-agent configuration changes, so a warning is warranted. The package does not show a concrete malicious chain beyond that extension setup and user-invoked browser automation.
Evidence
package.jsonscripts/install-skill.js.claude/skills/ttj-skills-playwright/SKILL.mddist/cli.jsdist/utils.js~/.claude/skills/ttj-skills-playwright/SKILL.md~/.agents/skills/ttj-skills-playwright/SKILL.md~/.ttj-skills-playwright-installed
Network endpoints2
registry.npmjs.org/ttj-skills-playwright/latest127.0.0.1:<CDP-port>

Decision evidence

public snapshot
AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
  • `package.json` runs `postinstall` automatically.
  • `scripts/install-skill.js` writes package content to `~/.claude/skills/ttj-skills-playwright` and `~/.agents/skills/ttj-skills-playwright`.
  • Installed skill instructs AI agents to invoke a CDP CLI and run generated automation code.
  • `dist/cli.js` exposes user-invoked arbitrary page JavaScript through `eval`.
  • Skill prescribes randomized delays for bot-detection avoidance.
Evidence against
  • No credential or environment-value collection found.
  • No exfiltration endpoint or remote payload download found.
  • Registry request only checks this package's latest version at runtime.
  • Browser/CDP control is activated by explicit CLI or skill invocation.
  • Lifecycle write is limited to a package-named first-party skill and marker file.
Behavioral surface
Source
ChildProcessEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 8 file(s), 50.4 KB of source, external domains: 127.0.0.1, example.com, registry.npmjs.org, www.google.com, www.naver.com

Source & flagged code

3 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/install-skill.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
dist/utils.jsView file
5import path from 'path'; L6: import net from 'net'; L7: import http from 'http'; L8: import https from 'https'; L9: import { exec } from 'child_process'; L10: import { promisify } from 'util'; ... L18: */ L19: export const getOsType = () => process.platform === 'win32' L20: ? 'windows' ... L26: */ L27: export const getHomeDir = () => os.homedir(); L28: /**
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/utils.jsView on unpkg · L5
scripts/install-skill.jsView file
14Install-time AI-agent control hijack evidence: L14: const skillName = 'ttj-sk[redacted]'; L15: const sk[redacted] = path.join(__dirname, '..', '.claude', 'skills', skillName); L16: const skillFile = 'SKILL.md'; ... L19: if (!fs.existsSync(dir)) { L20: fs.mkdirSync(dir, { recursive: true }); L21: } ... L53: // Claude Code: 기존 /ttj-sk[redacted] 호출 방식 유지 L54: const claudeTargetDir = path.join(homedir(), '.claude', 'skills', skillName); L55: const claudeTargetFile = path.join(claudeTargetDir, skillFile); L56: ensureDir(claudeTargetDir); L57: fs.copyFileSync(sourceFile, claudeTargetFile); L58: console.log(`✅ Claude Code 스킬 설치 완료: ${claudeTargetFile}`); Payload evidence from .claude/skills/ttj-sk[redacted]/SKILL.md: L84: L85: ### eval — run JS in the active tab (result printed as JSON to stdout) L86: ```bash ... L94: ```bash L95: ttj-sk[redacted] goto https://example.com L96: ttj-sk[redacted] goto example.com # https:// auto-prefixed
Critical
Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/install-skill.jsView on unpkg · L14

Findings

1 Critical2 High3 Medium5 Low
CriticalAi Agent Control Hijackscripts/install-skill.js
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilitydist/utils.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings