T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:33
- Finding
- Unpinned npm Package Retrieval and Immediate Execution## Vulnerability Details **File Location**: `SKILL.md:8` and `SKILL.md:33` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"clawdbot":{"emoji":"P","requires":{"bins":["node","npx"]},"os":["linux","darwin","win32"],"install":[{"id":"npm-playwright","kind":"npm","package":"playwright","bins":["playwright"],"label":"Install Playwright"},{"id":"npm-playwright-mcp","kind":"npm","package":"@playwright/mcp","bins":["playwright-mcp"],"label":"Install Playwright MCP (optional)"}]}} ``` ```bash npx @playwright/mcp --headless ``` ### Technical Analysis The Skill identifies `playwright` and `@playwright/mcp` as dependencies without pinning either package to an audited version. Its quick-start command invokes `npx @playwright/mcp` directly. If the package is not already installed locally, `npx` may retrieve the current package release from the configured npm registry and execute it immediately. Because no exact version or integrity value is specified, the effective executable payload can change after this Skill has been reviewed. This is an insecure supply-chain boundary rather than evidence that the currently named packages are malicious. The risk arises because future package releases, registry compromise, account takeover, or registry-configuration manipulation could cause unaudited code to run. ### Attack Path 1. An attacker compromises a package publisher account, registry infrastructure, or the environment's npm registry configuration. 2. The attacker makes a malicious package version available under a referenced package name or causes resolution to an attacker-controlled source. 3. An agent or user follows the documented command: ```bash npx @playwright/mcp --headless ``` 4. `npx` retrieves the mutable package version because the dependency is not installed or pinned. 5. npm lifecycle code or the package executable runs with the privileges of the invoking process. 6. T ...[truncated 900 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every executable dependency to an exact reviewed version: ```bash npx @playwright/mcp@<audited-exact-version> --headless ``` 2. Prefer installation through a committed `package.json` and lockfile rather than allowing `npx` to resolve a mutable release at invocation time. 3. After controlled installation, use: ```bash npx --no-install playwright-mcp --headless ``` This prevents `npx` from silently downloading a missing package. 4. Verify lockfile integrity in CI and use `npm ci` rather than dependency commands that update resolution. 5. Restrict package retrieval to an explicitly trusted registry and prevent untrusted project-level npm configuration from changing the registry. 6. Review dependency provenance and npm lifecycle scripts before upgrades. 7. Run browser tooling in an isolated environment with minimal filesystem access, restricted credentials, and constrained network permissions.