T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:33
- Finding
- Unpinned npm Package Retrieval and Execution Through npx## Vulnerability Details **File Location**: `SKILL.md`, lines 8 and 31-34 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium **Affected code:** ```yaml metadata: {"clawdbot":{"emoji":"P","requires":{"bins":["node","npx"]},"os":["linux","darwin","win32"],"install":[{"id":"npm-playwright","kind":"npm","package":"playwright","bins":["playwright"],"label":"Install Playwright"},{"id":"npm-playwright-mcp","kind":"npm","package":"@playwright/mcp","bins":["playwright-mcp"],"label":"Install Playwright MCP (optional)"}]}} ``` ```bash ### MCP browser path npx @playwright/mcp --headless ``` ### Technical Analysis The Skill recommends executing `@playwright/mcp` with `npx` without specifying an exact reviewed version, lockfile, or integrity value. Its installation metadata likewise names `playwright` and `@playwright/mcp` without version constraints. When the requested package is unavailable locally, `npx` may download the registry-selected package release and execute its lifecycle or runtime code immediately. The effective code can therefore change after this Skill has been audited. A compromise of the package publisher, npm account, registry delivery path, or a future malicious package release could cause users to execute code that was not included in the reviewed project. The package names appear to correspond to the declared Playwright functionality, and there is no evidence in the reviewed files that the Skill intentionally selects a typosquatted or known-malicious package. The risk arises from unpinned remote dependency execution rather than embedded malicious behavior. ### Attack Path 1. An attacker compromises the publication credentials or release process for one of the referenced npm packages, or otherwise causes a malicious release to be selected by the package manager. 2. The attacker publishes a package version containing malicious installation or runtime code. 3. A user follows ...[truncated 1509 chars]
- Remediation
- ## Remediation Suggestions 1. Pin each dependency to an exact, reviewed version instead of relying on the registry-selected release, for example: ```bash npm install --save-dev --save-exact @playwright/mcp@REVIEWED_VERSION ``` 2. Commit the generated lockfile and install dependencies using a lockfile-enforcing command such as: ```bash npm ci ``` 3. Execute only the locally installed, lockfile-resolved binary. Where appropriate, use: ```bash npx --no-install playwright-mcp --headless ``` Alternatively, invoke the binary through a pinned package script. 4. Add exact versions to the Skill installation metadata if its schema supports version constraints. 5. Verify package provenance, publisher identity, signatures or attestations, and registry integrity before approving dependency updates. 6. Review dependency changes and lockfile diffs through a controlled update process. Use automated vulnerability and supply-chain scanning as an additional control. 7. Run browser tooling in a sandbox or minimally privileged container with only the required workspace paths, secrets, and network destinations exposed. 8. Avoid placing unrelated credentials in the environment used to install or run the package, especially on CI runners.