registry / @cutleryapp/agent / 1.0.71

@cutleryapp/agent@1.0.71

Local agent that connects your machine to the Cutlery QA platform and runs UI tests via Playwright

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 293 KB of source, external domains: example.com

Source & flagged code

7 flagged

dist/mcp-executor.jsView file

Lines 555-595javascript

555 await page.waitForLoadState('domcontentloaded', { timeout: 5000 }).catch(() => { });

556 }

557 }

558 }

559 // 3a. Multi-field fill: "Fill firstname, lastname" → fill each with inferred value

560 if (!handled && /^(?:fill|type)\s+/i.test(raw) && !/\s+(?:in|into|with)\s+/i.test(raw)) {

561 const fieldsPart = raw.replace(/^(?:fill|type)\s+/i, "").trim();

562 const fields = fieldsPart.split(/,\s*/).map((f) => f.trim().replace(/^["']|["']$/g, "")).filter(Boolean);

563 if (fields.length > 1) {

564 const valueMap = {

565 firstname: "John", first: "John", fname: "John",

566 lastname: "Smith", last: "Smith", lname: "Smith", surname: "Smith",

567 name: "John Smith", fullname: "John Smith",

568 email: "john.smith@example.com", emailaddress: "john.smith@example.com",

569 phone: "9876543210", mobile: "9876543210", phonenumber: "9876543210", mobilenumber: "9876543210",

570 address: "123 Test Street", currentaddress: "123 Test Street", streetaddress: "123 Test Street",

571 city: "New York", state: "New York",

572 zip: "10001", zipcode: "10001", postalcode: "10001",

573 dob: "01/01/1990", dateofbirth: "01/01/1990", birthdate: "01/01/1990",

574 age: "30", username: "john.smith",

575 password: "Test@1234", company: "Acme Corp",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/mcp-executor.jsView on unpkg · L575

576 subject: "Mathematics", subjects: "Mathematics",

577 message: "This is a test message.", comment: "Test comment.",

578 description: "Test description.",

579 };

580 for (const field of fields) {

581 const key = field.toLowerCase().replace(/[\s_-]+/g, "");

582 // Test data first, then AI default map, then fallback

583 const dataValue = varMap[field] ?? varMap[key] ??

584 Object.entries(varMap).find(([k]) => k.toLowerCase().replace(/[\s_-]+/g, "") === key)?.[1];

585 const value = dataValue ?? valueMap[key] ?? "Test Value";

586 const src = dataValue ? "test data" : "AI default";

587 console.log(` ⌨️ Multi-fill: "${field}" → "${value}" (${src})`);

588 try {

589 await tryFill(page, field, value);

590 }

591 catch { /* ignore individual failures */ }

592 }

593 handled = true;

594 }

595 }

Lines 1851-1892javascript

1851 type,

1852 name,

1853 placeholder: input.placeholder || '',

1854 tagName: input.tagName.toLowerCase(),

1855 });

1856 }

1857 });

1858 return fieldsList;

1859 }, targetSection);

dist/cli.jsView file

Lines 26-68javascript

26 return ownKeys(o);

27 };

28 return function (mod) {

29 if (mod && mod.__esModule) return mod;

30 var result = {};

31 if (mod != null

Source & flagged code

7 flagged · loading source

dist/mcp-executor.jsView file

575patternName = generic_password severity = medium line = 575 matchedText = password...rp",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/mcp-executor.jsView on unpkg · L575

1871patternName = generic_password severity = medium line = 1871 matchedText = password...3!',

Medium

Secret Pattern

Hardcoded password in dist/mcp-executor.js

dist/mcp-executor.jsView on unpkg · L1871

1872patternName = generic_password severity = medium line = 1872 matchedText = confirmp...3!',

Medium

Secret Pattern

Hardcoded password in dist/mcp-executor.js

dist/mcp-executor.jsView on unpkg · L1872

dist/cli.jsView file

48const os = __importStar(require("os")); L49: const child_process_1 = require("child_process"); L50: const ws_1 = __importDefault(require("ws"));

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L48

46const path_1 = require("path"); L47: const http = __importStar(require("http")); L48: const os = __importStar(require("os")); L49: const child_process_1 = require("child_process"); L50: const ws_1 = __importDefault(require("ws")); ... L58: async function ensureBrowsersInstalled() { L59: if (process.env.CUTLERY_SKIP_BROWSER_INSTALL === "1") L60: return;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L46

48const os = __importStar(require("os")); L49: const child_process_1 = require("child_process"); L50: const ws_1 = __importDefault(require("ws")); ... L55: // browser binaries are downloaded separately (~300MB for chromium). Without L56: // this, the first `connect` from a fresh `npx @cutleryapp/agent` install fails L57: // with "Executable doesn't exist" the moment it tries to launch a test.

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L48

310patternName = generic_password severity = medium line = 310 matchedText = password...23",

Medium

Secret Pattern

Hardcoded password in dist/cli.js

dist/cli.jsView on unpkg · L310

Findings

3 High7 Medium5 Low

HighChild Processdist/cli.js

HighSame File Env Network Executiondist/cli.js

HighRuntime Package Installdist/cli.js

MediumSecret Patterndist/mcp-executor.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/mcp-executor.js

MediumSecret Patterndist/cli.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

dist/mcp-executor.jsView file

Lines 555-595javascript

555 await page.waitForLoadState('domcontentloaded', { timeout: 5000 }).catch(() => { });

556 }

557 }

558 }

559 // 3a. Multi-field fill: "Fill firstname, lastname" → fill each with inferred value

560 if (!handled && /^(?:fill|type)\s+/i.test(raw) && !/\s+(?:in|into|with)\s+/i.test(raw)) {

561 const fieldsPart = raw.replace(/^(?:fill|type)\s+/i, "").trim();

562 const fields = fieldsPart.split(/,\s*/).map((f) => f.trim().replace(/^["']|["']$/g, "")).filter(Boolean);

563 if (fields.length > 1) {

564 const valueMap = {

565 firstname: "John", first: "John", fname: "John",

566 lastname: "Smith", last: "Smith", lname: "Smith", surname: "Smith",

567 name: "John Smith", fullname: "John Smith",

568 email: "john.smith@example.com", emailaddress: "john.smith@example.com",

569 phone: "9876543210", mobile: "9876543210", phonenumber: "9876543210", mobilenumber: "9876543210",

570 address: "123 Test Street", currentaddress: "123 Test Street", streetaddress: "123 Test Street",

571 city: "New York", state: "New York",

572 zip: "10001", zipcode: "10001", postalcode: "10001",

573 dob: "01/01/1990", dateofbirth: "01/01/1990", birthdate: "01/01/1990",

574 age: "30", username: "john.smith",

575 password: "Test@1234", company: "Acme Corp",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/mcp-executor.jsView on unpkg · L575

576 subject: "Mathematics", subjects: "Mathematics",

577 message: "This is a test message.", comment: "Test comment.",

578 description: "Test description.",

579 };

580 for (const field of fields) {

581 const key = field.toLowerCase().replace(/[\s_-]+/g, "");

582 // Test data first, then AI default map, then fallback

583 const dataValue = varMap[field] ?? varMap[key] ??

584 Object.entries(varMap).find(([k]) => k.toLowerCase().replace(/[\s_-]+/g, "") === key)?.[1];

585 const value = dataValue ?? valueMap[key] ?? "Test Value";

586 const src = dataValue ? "test data" : "AI default";

587 console.log(` ⌨️ Multi-fill: "${field}" → "${value}" (${src})`);

588 try {

589 await tryFill(page, field, value);

590 }

591 catch { /* ignore individual failures */ }

592 }

593 handled = true;

594 }

595 }

Lines 1851-1892javascript

1851 type,

1852 name,

1853 placeholder: input.placeholder || '',

1854 tagName: input.tagName.toLowerCase(),

1855 });

1856 }

1857 });

1858 return fieldsList;

1859 }, targetSection);

dist/cli.jsView file

Lines 26-68javascript

26 return ownKeys(o);

27 };

28 return function (mod) {

29 if (mod && mod.__esModule) return mod;

30 var result = {};

31 if (mod != null

Lines 290-330javascript

290program

291 .command("example")

292 .description("Create an example test case JSON file")

293 .argument("[output]", "Output file path", "example-test.json")

294 .action((output) => {

295 const { writeFileSync } = require("fs");

296 const example = {

297 name: "Login Test Example",

298 test_case_id: "TC_EXAMPLE_001",

299 automated_steps: [

300 "Navigate to https://example.com",

301 "Wait 1 second",

302 'Fill "user@example.com" in "input[name=\'email\']"',

303 'Fill "password123" in "input[name=\'password\']"',

304 "Click \"button[type='submit']\"",

305 'Wait for "h1" to be visible',

306 'Check if "Welcome" is visible',

307 ],

308 test_variables: {

309 email: "user@example.com",

310 password: "password123",

Medium

Secret Pattern

Hardcoded password in dist/cli.js

dist/cli.jsView on unpkg · L310

311 },

312 };

313 writeFileSync(output, JSON.stringify(example, null, 2));

314 console.log(chalk_1.default.green(`✅ Created example test case: ${output}`));

315 console.log(chalk_1.default.gray(`\nRun it with: cutlery-agent run ${output}`));

316});

317function runConnect(opts) {

318 const agentName = opts.name;

319 const webAppUrl = opts.url.replace(/\/$/, "");

320 const wsUrl = webAppUrl.replace(/^http/, "ws") + "/api/test-agent";

321 const startedAt = new Date().toISOString();

322 const log = (msg) => { if (!opts.silent)

323 console.log(msg); };

324 if (!opts.silent) {

325 console.log(chalk_1.default.blue("🚀 Cutlery Test Agent"));

326 console.log(chalk_1.default.gray(` Agent Name: ${agentName}`));

327 console.log(chalk_1.default.gray(` Web App: ${webAppUrl}`));

328 console.log(chalk_1.default.gray(` WebSocket: ${wsUrl}`));

329 console.log(chalk_1.default.gray(` Browser: ${opts.headless ? 'headless' : 'visible (use --headless to hide)'}\n`));

330 }