T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:8
- Finding
- Unpinned npm Package Installation and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 8-33 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"clawdbot":{"emoji":"P","requires":{"bins":["node","npx"]},"os":["linux","darwin","win32"],"install":[{"id":"npm-playwright","kind":"npm","package":"playwright","bins":["playwright"],"label":"Install Playwright"},{"id":"npm-playwright-mcp","kind":"npm","package":"@playwright/mcp","bins":["playwright-mcp"],"label":"Install Playwright MCP (optional)"}]}} ``` ```bash npx @playwright/mcp --headless ``` ### Technical Analysis The installation metadata identifies `playwright` and `@playwright/mcp` without exact versions, while the quick-start command invokes `@playwright/mcp` through `npx` without a version constraint. If the package is not already available locally, `npx` can retrieve and execute the version resolved from the configured npm registry at runtime. This makes the effective executable payload mutable after the Skill has been audited. The Skill therefore relies on the continuing integrity of the npm registry, package publisher accounts, package dependencies, and local npm configuration. A compromised or unexpectedly modified release could execute arbitrary package lifecycle or runtime code under the account running the Skill. The documented network transmission to user-requested web origins is otherwise necessary for the declared browser-automation functionality and is explicitly disclosed. No hidden data-exfiltration mechanism was identified. ### Attack Path 1. An attacker compromises the publication account, release process, or transitive dependency of an unpinned npm package, or influences the registry configured in the execution environment. 2. The user or Agent follows the documented quick-start command: `npx @playwright/mcp --headless`. 3. npm resolves a package release at execution time rather than using a pr ...[truncated 987 chars]
- Remediation
- ## Remediation Suggestions 1. Pin both direct packages to reviewed exact versions rather than relying on registry-latest resolution. 2. Replace the quick-start command with an exact version, for example: ```bash npx --yes @playwright/mcp@<reviewed-exact-version> --headless ``` 3. Prefer declaring dependencies in `package.json`, committing the generated lockfile, installing with `npm ci`, and invoking the project-local binary. This provides deterministic dependency resolution. 4. Validate lockfile integrity in CI and use npm integrity metadata. Perform dependency updates through a controlled review process. 5. Disable or restrict unnecessary lifecycle scripts where operationally feasible, and execute browser tooling in a sandboxed, non-privileged environment with narrowly scoped filesystem and secret access. 6. Configure an approved registry explicitly and apply package provenance, signature, or allowlist verification where supported. 7. Keep browser credentials and sensitive environment variables out of the package-installation context whenever possible.