registry / ttj-skills-playwright / 1.4.10

ttj-skills-playwright@1.4.10

Drive an existing Chrome over CDP (Playwright core) with one-shot commands — eval, goto, click, type, wait, tabs, screenshot — plus page element visualization and crawl-target analysis. Skill for Claude Code & Codex.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. npm postinstall silently installs package-controlled agent instructions into global Claude Code and Codex skill directories. The installed skill can auto-invoke and directs agents to use its browser-control CLI.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

`npm install` or global installation executes `postinstall`.

Impact

Unconsented persistent agent behavior and tool-use guidance is added for future Claude Code/Codex sessions.

Mechanism

Postinstall writes package-supplied AI-agent skill files into global agent control surfaces.

Policy narrative

Installing the package executes `scripts/install-skill.js`, which copies a package-controlled skill into global Claude Code and Codex agent directories and creates an installation marker. The installed skill declares broad auto-invocation patterns and Bash/Read/Write permissions, making future agent behavior depend on unconsented package-supplied instructions. Its browser automation functions are user-facing, but they do not remove the install-time agent-control-surface mutation.

Rationale

The concrete postinstall mutation of global third-party AI-agent skill directories meets the block boundary. No separate exfiltration chain is needed for this verdict.

Evidence

package.jsonscripts/install-skill.js.claude/skills/ttj-skills-playwright/SKILL.mddist/utils.jsdist/browser.js~/.claude/skills/ttj-skills-playwright/SKILL.md~/.agents/skills/ttj-skills-playwright/SKILL.md~/.ttj-skills-playwright-installed

Network endpoints1

registry.npmjs.org/ttj-skills-playwright/latest

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for policy block

`package.json` runs `postinstall` on npm installation.
`scripts/install-skill.js` copies package `SKILL.md` into `~/.claude/skills/ttj-skills-playwright/`.
`scripts/install-skill.js` writes a converted skill into `~/.agents/skills/ttj-skills-playwright/`.
`.claude/skills/ttj-skills-playwright/SKILL.md` enables broad auto-invocation and permits Bash, Read, and Write.
The lifecycle script creates `~/.ttj-skills-playwright-installed` without user interaction.

Evidence against

No credential harvesting or external data-exfiltration code was found.
The only package network endpoint inspected is npm registry version checking.
Browser/CDP automation is exposed as explicit CLI functionality, not an install-time payload.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 10 file(s), 87.3 KB of source, external domains: 127.0.0.1, example.com, registry.npmjs.org, www.google.com, www.naver.com

Source & flagged code

6 flagged

package.jsonView file

Lines 1-39json

2 "name": "ttj-skills-playwright",

3 "version": "1.4.10",

4 "description": "Drive an existing Chrome over CDP (Playwright core) with one-shot commands — eval, goto, click, type, wait, tabs, screenshot — plus page element visualization and crawl-target analysis. Skill for Claude Code & Codex.",

5 "type": "module",

6 "bin": {

7 "ttj-skills-playwright": "dist/cli.js"

8 },

9 "main": "./dist/cli.js",

10 "files": [

11 "dist",

12 ".claude/skills",

13 "scripts"

14 ],

15 "scripts": {

16 "build": "tsc",

17 "start": "node dist/cli.js",

18 "prepare": "npm run build",

19 "postinstall": "node scripts/install-skill.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L19

20 },

21 "dependencies": {

22 "chalk": "^5.3.0",

23 "playwright-core": "^1.61.1"

24 },

25 "devDependencies": {

26 "typescript": "^5.4.0",

27 "@types/node": "^20.11.0"

28 },

29 "keywords": [

30 "playwright",

31 "cdp",

32 "chrome",

33 "browser",

34 "automation",

35 "cli",

36 "crawl",

37 "scraping",

38 "claude",

39 "codex",

dist/utils.jsView file

Lines 1-25javascript

1/**

2 * ttj-skills-playwright - Utility functions (pure where possible)

3 */

4import os from 'os';

5import path from 'path';

6import net from 'net';

7import http from 'http';

scripts/install-skill.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * Claude Code / Codex 스킬 자동 설치

4 * npm install 후 Claude Code와 Codex의 사용자 전역 스킬 위치에 복사합니다.

5 */

7import fs from 'fs';

8import path from 'path';

9import { fileURLToPath } from 'url';

dist/cli.jsView file

•matchType = normalized_sha256 matchedPackage = ttj-sk[redacted]@1.4.9 matchedPath = dist/cli.js matchedIdentity = npm:dHRqLXNraWxscy1wbGF5d3JpZ2h0:1.4.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

dist/browser.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = ttj-sk[redacted]@1.4.6 matchedIdentity = npm:dHRqLXNraWxscy1wbGF5d3JpZ2h0:1.4.6 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/browser.jsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-skill.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/utils.jsView file

5import path from 'path'; L6: import net from 'net'; L7: import http from 'http'; L8: import https from 'https'; L9: import { exec } from 'child_process'; L10: import { promisify } from 'util'; ... L18: */ L19: export const getOsType = () => process.platform === 'win32' L20: ? 'windows' ... L26: */ L27: export const getHomeDir = () => os.homedir(); L28: /**

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/utils.jsView on unpkg · L5

•matchType = normalized_sha256 matchedPackage = ttj-sk[redacted]@1.4.9 matchedPath = dist/utils.js matchedIdentity = npm:dHRqLXNraWxscy1wbGF5d3JpZ2h0:1.4.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils.jsView on unpkg

scripts/install-skill.jsView file

14Install-time AI-agent control hijack evidence: L14: const skillName = 'ttj-sk[redacted]'; L15: const sk[redacted] = path.join(__dirname, '..', '.claude', 'skills', skillName); L16: const skillFile = 'SKILL.md'; ... L19: if (!fs.existsSync(dir)) { L20: fs.mkdirSync(dir, { recursive: true }); L21: } ... L53: // Claude Code: 기존 /ttj-sk[redacted] 호출 방식 유지 L54: const claudeTargetDir = path.join(homedir(), '.claude', 'skills', skillName); L55: const claudeTargetFile = path.join(claudeTargetDir, skillFile); L56: ensureDir(claudeTargetDir); L57: fs.copyFileSync(sourceFile, claudeTargetFile); L58: console.log(`✅ Claude Code 스킬 설치 완료: ${claudeTargetFile}`); Payload evidence from .claude/skills/ttj-sk[redacted]/SKILL.md: L40: L41: When the skill is activated, always start with the bare command `ttj-sk[redacted]` (no subcommand). It checks the dedicated ttj profile browser on CDP port 9227 (probing the p... L42: ... L135: ```bash L136: ttj-sk[redacted] goto https://example.com L137: ttj-sk[redacted] goto example.com # https:// auto-prefixed

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/install-skill.jsView on unpkg · L14

dist/cli.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

dist/browser.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/browser.jsView on unpkg

Findings

1 Critical5 High3 Medium5 Low

CriticalAi Agent Control Hijackscripts/install-skill.js

HighInstall Time Lifecycle Scriptspackage.json

HighSandbox Evasion Gated Capabilitydist/utils.js

HighKnown Malware Source Similaritydist/utils.js

HighKnown Malware Source Similaritydist/cli.js

HighPrevious Version Dangerous Deltadist/browser.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

package.jsonView file

Lines 1-39json

2 "name": "ttj-skills-playwright",

3 "version": "1.4.10",

5 "type": "module",

6 "bin": {

7 "ttj-skills-playwright": "dist/cli.js"

8 },

9 "main": "./dist/cli.js",

10 "files": [

11 "dist",

12 ".claude/skills",

13 "scripts"

14 ],

15 "scripts": {

16 "build": "tsc",

17 "start": "node dist/cli.js",

18 "prepare": "npm run build",

19 "postinstall": "node scripts/install-skill.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L19

20 },

21 "dependencies": {

22 "chalk": "^5.3.0",

23 "playwright-core": "^1.61.1"

24 },

25 "devDependencies": {

26 "typescript": "^5.4.0",

27 "@types/node": "^20.11.0"

28 },

29 "keywords": [

30 "playwright",

31 "cdp",

32 "chrome",

33 "browser",

34 "automation",

35 "cli",

36 "crawl",

37 "scraping",

38 "claude",

39 "codex",

dist/utils.jsView file

Lines 1-25javascript

1/**

2 * ttj-skills-playwright - Utility functions (pure where possible)

3 */

4import os from 'os';

5import path from 'path';

6import net from 'net';

7import http from 'http';

scripts/install-skill.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * Claude Code / Codex 스킬 자동 설치

4 * npm install 후 Claude Code와 Codex의 사용자 전역 스킬 위치에 복사합니다.

5 */

7import fs from 'fs';

8import path from 'path';

9import { fileURLToPath } from 'url';

dist/cli.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

dist/browser.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/browser.jsView on unpkg