T08 · Insecure Dependencies
- Location
SKILL.md:211- Finding
Unpinned Third-Party Packages Are Downloaded and Executed
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:211-251,SKILL.md:315,references/playwright-mcp.md:11-67,references/image-generation.md:29-31
Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: HighVulnerable Code
SKILL.md:211-218:markdown **Claude Code** ```bash claude mcp add playwright -- npx @playwright/mcp@latestCodex
bash codex mcp add playwright -- npx @playwright/mcp@latesttext `SKILL.md:249-251`: ```markdown **Standalone MCP Server (headless environments or worker processes)** ```bash npx @playwright/mcp@latest --port 8931text `SKILL.md:315`: ```markdown - if the Chromium browser runtime is not installed, run `npx playwright install chromium` before continuingreferences/playwright-mcp.md:11-18:markdown **Claude Code** ```bash claude mcp add playwright -- npx @playwright/mcp@latestCodex
bash codex mcp add playwright -- npx @playwright/mcp@latesttext `references/playwright-mcp.md:49-67`: ```markdown **Standalone MCP Server (headless environments or worker processes)** ```bash npx @playwright/mcp@latest --port 8931Then point the client config to:
json { "mcpServers": { "playwright": { "url": "http://localhost:8931/mcp" } } }Install the browser runtime the first time:
bash npx playwright install chromiumtext `references/image-generation.md:29-31`: ```markdown Python dependency: ```bash pip install requeststext ### Technical Analysis The mandatory setup instructions execute packages resolved dynamically from public package registries. In particular, `@playwright/mcp@latest` explicitly selects a mutable release rather than a version reviewed alongside this skill. The `npx playwright` command and the unconstrained `pip install requests` command also lack exact versions, lockfiles, and integrity hashes. When `npx` cannot find the requested package locally, it can download and execute it from t ...[truncated 2696 chars]- Remediation
View remediation
Remediation Suggestions
-
Replace
@latestwith an exact, reviewed Playwright MCP version:bash npx --yes @playwright/mcp@<reviewed-exact-version> -
Pin the Playwright package used to install Chromium rather than relying on implicit registry resolution:
bash npx --yes playwright@<reviewed-exact-version> install chromium -
Add an npm lockfile with committed integrity metadata where package installation is managed as part of the project.
-
Replace the unconstrained Python installation command with a reviewed requirements file containing an exact version and hash:
text requests==<reviewed-exact-version> --hash=sha256:<verified-hash>Install it with:
bash python -m pip install --require-hashes -r requirements.txt -
Document the expected official package publisher, registry, and package identity so users can detect typosquatting or registry substitution.
-
Run the MCP server with least privilege and restrict inherited environment variables to only those required for the current task.
-
Isolate browser automation in a sandbox or container with narrowly scoped filesystem and network access.
-
Review and test dependency updates before changing pinned versions. Do not automatically track mutable release tags in mandatory execution instructions.
-