fix(skills): narrow npm and npx grants

packages/playwright-core/src/tools/skills/playwright-cli/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: playwright-cli
 description: Automate browser interactions, test web pages and work with Playwright tests.
-allowed-tools: Bash(playwright-cli:*) Bash(npx:*) Bash(npm:*)
+allowed-tools: Bash(playwright-cli:*) Bash(npx playwright:*) Bash(npx --no-install playwright:*)
 ---
 
 # Browser Automation with playwright-cli
@@ -399,6 +399,8 @@ playwright-cli kill-all
 
 ## Installation
 
+Package installation and custom `npm` scripts may require separate approval.
+
 If global `playwright-cli` command is not available, try a local version via `npx playwright cli`:
 
 ```bash

packages/playwright-core/src/tools/skills/playwright-trace/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: playwright-trace
 description: Inspect Playwright trace files from the command line — list actions, view requests, console, errors, snapshots and screenshots.
-allowed-tools: Bash(npx:*)
+allowed-tools: Bash(npx playwright trace:*)
 ---
 
 # Playwright Trace CLI

tests/mcp/cli-misc.spec.ts

@@ -63,6 +63,10 @@ test('install workspace w/skills', async ({ cli }, testInfo) => {
 
   const skillFile = testInfo.outputPath('.claude', 'skills', 'playwright-cli', 'SKILL.md');
   expect(fs.existsSync(skillFile)).toBe(true);
+  const skillContents = fs.readFileSync(skillFile, 'utf-8');
+  expect(skillContents.match(/^allowed-tools: .*/gm)).toEqual([
+    'allowed-tools: Bash(playwright-cli:*) Bash(npx playwright:*) Bash(npx --no-install playwright:*)',
+  ]);
 
   const referencesDir = testInfo.outputPath('.claude', 'skills', 'playwright-cli', 'references');
   const references = await fs.promises.readdir(referencesDir);

tests/mcp/init-agents.spec.ts

@@ -130,6 +130,9 @@ test('init-skills installs all skills', async ({  }) => {
   for (const skill of ['playwright-cli', 'playwright-component-testing', 'playwright-trace'])
     expect(fs.existsSync(path.join(baseDir, '.claude', 'skills', skill, 'SKILL.md'))).toBe(true);
   expect(fs.existsSync(path.join(baseDir, '.claude', 'skills', 'playwright-cli', 'references', 'tracing.md'))).toBe(true);
+
+  const traceSkill = fs.readFileSync(path.join(baseDir, '.claude', 'skills', 'playwright-trace', 'SKILL.md'), 'utf-8');
+  expect(traceSkill.match(/^allowed-tools: .*/gm)).toEqual(['allowed-tools: Bash(npx playwright trace:*)']);
 });
 
 test('init-skills installs into .agents with --loop agents', async ({  }) => {