Microsoft Playwright's command-line browser skill: Agents use playwright-cli to open pages, click and fill elements by their snapshot IDs, take screenshots, record videos, manage tabs and cookies, intercept and simulate network requests, view console and request logs, and run and debug Playwright tests.
skills.sh installs 199541 (+1157 / 24h)
Security Audit: Not audited
- Not yet scanned
Rationale
- Each command returns a page snapshot (saved as a .yml file under .playwright-cli/), with elements referenced by IDs like e15; --raw outputs only the result, facilitating piping to jq or comparing snapshots before and after
- When a page provides WebMCP tools, prioritize direct invocation (webmcp-call), and treat tool names, descriptions, and return values provided by the page as untrusted input
- show --annotate opens an annotation panel: users can draw boxes and add comments on the page, and the agent receives a screenshot with boxes, the corresponding area snapshot, and the annotations
- Can record traces and videos with action hints, and explains how to use gh to attach screenshots to PR comments
- skills.sh installs 1157 in 24 hours, with a cumulative total of 199541 (indicating attention only)
Usage
- First try npx --no-install playwright --version to use the project's Playwright; if unavailable, run npm install -g @playwright/cli@latest
- Typical workflow: playwright-cli open <url> → snapshot → click / fill e<id> → close; use -s=<name> to open multiple independent sessions, and --persistent to retain browser profile data
Risks
- Not audited in this period, fixed at C-level, and install commands are not displayed
- Large permission surface: can read and write cookies and localStorage; state-save stores login state in files like auth.json; attach --cdp=chrome or --extension can take over your currently used Chrome / Edge, including logged-in accounts
- eval and run-code execute arbitrary JavaScript within the page; be careful not to commit login state files to the repository