T08 · Insecure Dependencies
Error
- Location
- SKILL.md:18
- Finding
- Mutable Playwright MCP Dependency Is Automatically Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:18-25, 37-43`; `references/usage-patterns.md:3-10`; `scripts/validate.sh:40-49` **Vulnerability Type**: Unpinned runtime dependency and automatic remote package execution **Risk Level**: High ### Vulnerable Code `SKILL.md:18-25`: ```markdown Endpoint candidate inputs before finalizing: - Raw package form from docs: `npx @playwright/mcp@latest` - Reliable non-interactive form: `npx -y @playwright/mcp@latest` - Isolated/headless stable form (default for this skill): - `npx -y @playwright/mcp@latest --headless --isolated` - Shared-profile headless form (for persistent login state): - `npx -y @playwright/mcp@latest --headless --user-data-dir ~/.uxc/playwright-profile` - Shared-profile headed form (for interactive debug with same login state): - `npx -y @playwright/mcp@latest --user-data-dir ~/.uxc/playwright-profile` ``` `SKILL.md:37-43`: ```markdown 3. Use fixed link command by default: - `command -v playwright-mcp-cli` - If missing, create it: - `uxc link playwright-mcp-cli "npx -y @playwright/mcp@latest --headless --isolated"` - Optional shared-profile dual command setup for persistent sessions: - `command -v playwright-mcp-headless` - `command -v playwright-mcp-ui` ``` `references/usage-patterns.md:3-10`: ```markdown All commands in this skill use the fixed stdio endpoint: `npx -y @playwright/mcp@latest --headless --isolated` This skill defaults to fixed link command `playwright-mcp-cli`. Create it when missing: ```bash command -v playwright-mcp-cli uxc link playwright-mcp-cli "npx -y @playwright/mcp@latest --headless --isolated" ``` ``` `scripts/validate.sh:40-49`: ```bash if ! rg -q 'npx -y @playwright/mcp@latest --headless --isolated' "${SKILL_FILE}"; then fail "SKILL.md must document fixed Playwright MCP stdio endpoint" fi if ! rg -q 'command -v playwright-mcp-cli' "${SKILL_FILE}"; then fail "SKILL.md must include link command existence check" f ...[truncated 2806 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace every `@latest` reference with an exact, reviewed version, for example: ```bash npx -y @playwright/mcp@<reviewed-exact-version> --headless --isolated ``` Do not use version ranges, mutable tags, or unspecified versions. 2. Prefer installing dependencies through a committed lockfile with integrity metadata rather than fetching them dynamically during each skill invocation. 3. Where practical, install the reviewed package during a controlled setup phase and execute the locally installed binary afterward. Runtime operation should not implicitly download new code. 4. Update `scripts/validate.sh` to reject mutable references such as `@latest` and require the approved exact version. The validation should also ensure that every documented invocation uses the same pinned version. 5. Introduce an explicit dependency-update process that includes: - Review of upstream release notes and source changes. - Package provenance and publisher verification. - Lockfile and integrity-hash updates. - Security testing before changing the approved version. 6. Protect shared browser profiles with restrictive filesystem permissions and avoid exposing persistent authenticated profiles to newly updated or unreviewed dependency versions. 7. Consider running browser automation in a sandbox or isolated account with minimal filesystem access, restricted environment variables, and controlled network access to reduce the impact of a compromised dependency. ]]>