T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:4
- Finding
- Unpinned npm and npx Packages Execute Mutable Third-Party Code## Vulnerability Details **File Location**: `SKILL.md:4, 13-15, 20, 27` **Vulnerability Type**: Unpinned third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"openclaw":{"emoji":"🎭","os":["linux","darwin","win32"],"requires":{"bins":["playwright-mcp","npx"]},"install":[{"id":"npm-playwright-mcp","kind":"npm","package":"@playwright/mcp","bins":["playwright-mcp"],"label":"Install Playwright MCP"}]}} ``` ```bash npm install -g @playwright/mcp # Or npx @playwright/mcp ``` ```bash npx playwright install chromium ``` ```bash npx @playwright/mcp ``` ### Technical Analysis The installation and execution instructions do not pin exact versions of `@playwright/mcp` or `playwright`. As a result, npm resolves package contents from the configured registry at execution time. The project provides no lockfile, integrity checksum, or other mechanism that binds installation to a previously reviewed artifact. Both `npm install` and `npx` may download and execute third-party package code, including npm lifecycle scripts. Therefore, the code ultimately executed can change after this skill has been audited. Global installation through `npm install -g` also places package executables in a system-wide tool location available to the current user. This finding represents a supply-chain weakness rather than evidence that the named packages are currently malicious. ### Attack Path 1. An attacker compromises the relevant npm package, publisher account, registry distribution path, or a future package release. 2. The attacker publishes code containing a malicious lifecycle script or executable payload. 3. A user follows the skill documentation and runs an unversioned `npm install` or `npx` command. 4. npm resolves and downloads the attacker-controlled release because no reviewed version or integrity value is specified. 5. The malicious package code executes with the privileges of the user running the command. 6. For global installation, an attac ...[truncated 851 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every npm package to an exact reviewed version, including metadata installation declarations and command examples: ```bash npm install --global @playwright/mcp@EXACT_REVIEWED_VERSION npx --no-install @playwright/mcp@EXACT_REVIEWED_VERSION npx --package=playwright@EXACT_REVIEWED_VERSION --no-install playwright install chromium ``` 2. Prefer a project-local installation over a global installation to limit system-wide exposure: ```bash npm install --save-exact @playwright/mcp@EXACT_REVIEWED_VERSION ``` 3. Commit a lockfile generated by a supported npm version and use `npm ci` for reproducible installation. 4. Preserve and verify npm integrity metadata. Where the deployment workflow permits it, independently verify package checksums, provenance attestations, publisher identity, and registry configuration before installation. 5. Prevent `npx` from silently downloading missing packages. Preinstall the reviewed dependency and use `--no-install` or the equivalent supported npm option. 6. Run browser automation and package installation as an unprivileged user in an isolated environment with restricted filesystem and network access. 7. Establish a dependency update process that reviews release notes, package ownership, lifecycle scripts, transitive dependency changes, and artifact integrity before changing the pinned version.