T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:82
- Finding
- Unpinned Third-Party Dependency Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:82-91`, with related execution guidance at `SKILL.md:103-108` and `modules/spec-execution.md:72-97, 137` **Vulnerability Type**: Unpinned npm dependency installation and execution without integrity controls **Risk Level**: Medium ### Vulnerable Code ```markdown Check that Playwright is available: ```bash npx playwright --version ``` **Verification:** Run the command with `--help` flag to verify availability. If not installed, the user should run: ```bash npm install -D @playwright/test npx playwright install chromium ``` ``` The installed package and user-provided specification are subsequently executed: ```markdown Run the spec with video enabled: ```bash npx playwright test <spec-file> --config=playwright.config.ts ``` ``` Related module instructions also invoke the dependency directly: ```bash npx playwright test specs/demo.spec.ts npx playwright test specs/demo.spec.ts --config=playwright.recording.config.ts npx playwright test --headed npx playwright test --project=chromium npx playwright test --timeout=60000 npx playwright test --debug ``` ### Technical Analysis The installation command does not pin `@playwright/test` to a reviewed version and does not require a lockfile, package integrity verification, or a trusted registry. Consequently, the installed package can vary between runs as upstream releases and registry resolution change. By default, `npm install` can execute package lifecycle scripts with the privileges of the invoking user. In addition, `npx playwright` resolves and executes a package binary; depending on the local environment and npm configuration, `npx` may offer to retrieve a missing package. The `npx playwright install chromium` command also downloads browser components without the skill documenting validation or provenance requirements. The workflow then executes the selected Playwright specification and configuration. Playwright test files and configuration fi ...[truncated 1929 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `@playwright/test` to a reviewed exact version instead of installing the latest matching release: ```bash npm install --save-dev --save-exact @playwright/test@<reviewed-version> ``` 2. Commit and review `package-lock.json`, then use deterministic installation in automated environments: ```bash npm ci ``` 3. Configure npm to use an explicitly trusted registry and preserve lockfile integrity metadata. Review dependency provenance and published checksums before approving upgrades. 4. Where compatible with the project, initially install dependencies with lifecycle scripts disabled: ```bash npm ci --ignore-scripts ``` If required scripts must run, review them first and execute them in an isolated environment. 5. Invoke the already installed project-local binary and prevent implicit package retrieval: ```bash npx --no-install playwright test specs/demo.spec.ts ``` Alternatively, use the package-manager command that guarantees execution from the locked project dependency. 6. Pin and control Playwright browser revisions through the reviewed Playwright package and cache browsers from a trusted source. Avoid downloading browser components during a privileged or unrestricted workflow. 7. Treat Playwright specifications and configuration files as executable code. Require review of the complete spec, imported modules, fixtures, reporters, global setup/teardown, and configuration before execution. 8. Run untrusted or externally supplied specifications in a disposable container or sandbox with: - No host secrets or unnecessary environment variables. - A read-only project mount where practical. - A dedicated writable output directory. - Restricted outbound network access. - No privileged container mode or host socket mounts. - A non-administrative user. 9. Update the skill documentation so validation includes version verification, lockfile verification, source review, an ...[truncated 64 chars]