This skill drives a real browser on the machine it runs on and records the screen content of that browser window. Treat the recordings as sensitive: they show whatever the app showed, including real data.

Rules the skill enforces and contributors must preserve:

• Credentials never appear in command output, logs, or recordings of login steps. Login belongs in the project's ensure-auth hook, which must keep secrets in variables and never echo them.
• The browser session is isolated per project. The close verb only touches this project's browser daemon.
• The skill writes only under the project's .playwright-cli/ directory and the state directory ${XDG_STATE_HOME:-~/.local/state}/verify-ui/.

To report a vulnerability, open a GitHub issue with the label security, or use GitHub private vulnerability reporting if enabled on the repository.