Audit candidate: lackeyjb/playwright-skill

[xiaolai]

Repo

https://github.com/lackeyjb/playwright-skill

Field	Value
Stars	2607
Source	manual queue (2026-05-12 discovery batch)
Description	Claude Code Skill for browser automation with Playwright. Model-invoked - Claude autonomously writes and executes custom automation for testing and validation.

Next Steps

1. Review the repo — check CONTRIBUTING.md, recent activity, PR history
2. If worthy: add label audit-ready to trigger the audit workflow
3. If not: close this issue

Checklist

• Accepts contributions
• Updated in last 60 days
• Not a fork or mirror
• Has meaningful NL artifacts

[github-actions]

Audit Complete: lackeyjb/playwright-skill

NL Score: 98/100 | Security: CLEAR | Artifacts: 2 | Strategy: single

NLPM Audit: lackeyjb/playwright-skill

Date: 2026-05-12 | Artifacts: 2 | Strategy: single
NL Score: 98/100
Security: CLEAR
Bugs: 1 | Quality Issues: 1 | Security Findings: 1

NL Score Summary

File	Type	Score	Top Issue
skills/playwright-skill/SKILL.md	Skill	97/100	"comprehensive" — borderline R01 vague quantifier
.claude-plugin/plugin.json	Plugin Manifest	100/100	None

Scoring Notes

skills/playwright-skill/SKILL.md — 97/100

The skill is exceptionally well-written. Valid frontmatter with name and description. Description follows R04 (trigger, not summary): enumerates specific use-cases with user-query phrasing. CRITICAL WORKFLOW uses numbered steps per R14 spirit. Six code-example patterns plus two interaction examples in "Example Usage" satisfy R06 and the spirit of R09 for skills. Line count is 454 — under the R05 500-line ceiling. Concrete, imperative instructions dominate; minimal padding.

Deductions applied:

• "comprehensive Playwright API documentation" (line 373): borderline R01. "Comprehensive" is not in the R01 enumerated list but is functionally vague — it tells Claude nothing actionable about what the reference contains. −2
• "Clean test scripts" (description, line 3): "clean" is subjective with no measurable criteria. −1

.claude-plugin/plugin.json — 100/100

Valid manifest with all required fields: name, version, description, author, license, repository, keywords. No NL-specific penalties applicable to JSON manifests. The "model-invoked" keyword is correct for a skill consumed at inference time.

Security Scan

Severity	Count
Critical	0
High	0
Medium	0
Low	1

Execution Surface Inventory

Surface	Files
Hooks	0
Scripts	0
MCP configs	0
Package manifests	skills/playwright-skill/package.json

Security Findings

#	Severity	File	Line	Pattern	Description
1	Low	skills/playwright-skill/package.json	20	SEC-unpinned-semver	"playwright": "^1.57.0" — caret allows automatic minor-version updates; a supply-chain compromise in any minor playwright release would silently propagate.

Notes on inline execution pattern: The SKILL.md instructs Claude to pass LLM-generated JavaScript as an inline argument to node run.js "...". Because the code string is composed by the model, not interpolated from unsanitized user shell input, this is not a shell injection vector. No additional finding raised.

Bugs (PR-worthy)

---

Full report: https://github.com/xiaolai/nlpm-for-claude/blob/main/auditor/audits/lackeyjb-playwright-skill.md

2 bug(s) found. To submit fix PRs to the target repo, add the contribute-approved label to this issue.

[github-actions]

No high-confidence findings — no PRs opened

The audit produced no findings at confidence: high.
Medium / low / unspecified-confidence findings are kept in
the audit data for our own learning but never become PRs.
This keeps maintainers free of unverified suggestions.

[github-actions]

No high-confidence findings — no PRs opened

The audit produced no findings at confidence: high.
Medium / low / unspecified-confidence findings are kept in
the audit data for our own learning but never become PRs.
This keeps maintainers free of unverified suggestions.

[github-actions]

No high-confidence findings — no PRs opened

The audit produced no findings at confidence: high.
Medium / low / unspecified-confidence findings are kept in
the audit data for our own learning but never become PRs.
This keeps maintainers free of unverified suggestions.