registry / @cutleryapp/agent / 1.0.71

@cutleryapp/agent@1.0.71

Local agent that connects your machine to the Cutlery QA platform and runs UI tests via Playwright

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 293 KB of source, external domains: example.com

Source & flagged code

7 flagged

dist/mcp-executor.jsView file

Lines 555-595javascript

555 await page.waitForLoadState('domcontentloaded', { timeout: 5000 }).catch(() => { });

556 }

557 }

558 }

559 // 3a. Multi-field fill: "Fill firstname, lastname" → fill each with inferred value

560 if

Source & flagged code

7 flagged · loading source

dist/mcp-executor.jsView file

575patternName = generic_password severity = medium line = 575 matchedText = password...rp",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/mcp-executor.jsView on unpkg · L575

1871patternName = generic_password severity = medium line = 1871 matchedText = password...3!',

Medium

Secret Pattern

Hardcoded password in dist/mcp-executor.js

dist/mcp-executor.jsView on unpkg · L1871

1872patternName = generic_password severity = medium line = 1872 matchedText = confirmp...3!',

Medium

Secret Pattern

Hardcoded password in dist/mcp-executor.js

dist/mcp-executor.jsView on unpkg · L1872

dist/cli.jsView file

48const os = __importStar(require("os")); L49: const child_process_1 = require("child_process"); L50: const ws_1 = __importDefault(require("ws"));

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L48

46const path_1 = require("path"); L47: const http = __importStar(require("http")); L48: const os = __importStar(require("os")); L49: const child_process_1 = require("child_process"); L50: const ws_1 = __importDefault(require("ws")); ... L58: async function ensureBrowsersInstalled() { L59: if (process.env.CUTLERY_SKIP_BROWSER_INSTALL === "1") L60: return;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L46

48const os = __importStar(require("os")); L49: const child_process_1 = require("child_process"); L50: const ws_1 = __importDefault(require("ws")); ... L55: // browser binaries are downloaded separately (~300MB for chromium). Without L56: // this, the first `connect` from a fresh `npx @cutleryapp/agent` install fails L57: // with "Executable doesn't exist" the moment it tries to launch a test.

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L48

310patternName = generic_password severity = medium line = 310 matchedText = password...23",

Medium

Secret Pattern

Hardcoded password in dist/cli.js

dist/cli.jsView on unpkg · L310

Findings

3 High7 Medium5 Low

HighChild Processdist/cli.js

HighSame File Env Network Executiondist/cli.js

HighRuntime Package Installdist/cli.js

MediumSecret Patterndist/mcp-executor.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/mcp-executor.js

MediumSecret Patterndist/cli.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Lines 1851-1892javascript

1851 type,

1852 name,

1853 placeholder: input.placeholder || '',

1854 tagName: input.tagName.toLowerCase(),

1855 });

1856 }

1857 });

1858 return fieldsList;

1859 }, targetSection);

1860 if (fields.length === 0) {

1861 throw new Error(`No form fields found in "${targetSection}"`);

1862 }

1863 // Generate dummy data based on field type/name

1864 const dummyData = {

1865 email: 'testuser@example.com',

1866 username: 'testuser123',

1867 firstname: 'John',

1868 lastname: 'Doe',

1869 fullname: 'John Doe',

1870 name: 'John Doe',

1871 password: 'TestPass@123!',

Medium

Secret Pattern

Hardcoded password in dist/mcp-executor.js

dist/mcp-executor.jsView on unpkg · L1871

1872 confirmpassword: 'TestPass@123!',

Medium

Secret Pattern

Hardcoded password in dist/mcp-executor.js

dist/mcp-executor.jsView on unpkg · L1872

1873 phone: '5551234567',

1874 address: '123 Main Street',

1875 city: 'New York',

1876 state: 'NY',

1877 country: 'United States',

1878 zipcode: '10001',

1879 postalcode: '10001',

1880 company: 'Test Company',

1881 website: 'https://example.com',

1882 message: 'This is a test message',

1883 comment: 'Test comment',

1884 description: 'Test description',

1885 bio: 'Test bio',

1886 };

1887 // Fill each field

1888 let filledCount = 0;

1889 for (const field of fields) {

1890 const fieldNameLower = `${field.name}${field.placeholder}`.toLowerCase();

1891 let value = 'test';

1892 // First, check if value exists in captured variables (from dataset)

dist/cli.jsView file

Lines 26-68javascript

26 return ownKeys(o);

27 };

28 return function (mod) {

29 if (mod && mod.__esModule) return mod;

30 var result = {};

31 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

32 __setModuleDefault(result, mod);

33 return result;

34 };

35})();

36var __importDefault = (this && this.__importDefault) || function (mod) {

37 return (mod && mod.__esModule) ? mod : { "default": mod };

38};

39Object.defineProperty(exports, "__esModule", { value: true });

40exports.runConnect = runConnect;

41const chalk_1 = __importDefault(require("chalk"));

42const commander_1 = require("commander");

43const dotenv_1 = __importDefault(require("dotenv"));

44const fs_1 = require("fs");

45const ora_1 = __importDefault(require("ora"));

46const path_1 = require("path");

47const http = __importStar(require("http"));

48const os = __importStar(require("os"));

49const child_process_1 = require("child_process");

50const ws_1 = __importDefault(require("ws"));

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L48

51const playwright_1 = require("playwright");

52const mcp_executor_js_1 = require("./mcp-executor.js");

53const AGENT_VERSION = "1.0.0";

54// First-run browser bootstrap. Playwright ships its driver via npm but the

55// browser binaries are downloaded separately (~300MB for chromium). Without

56// this, the first `connect` from a fresh `npx @cutleryapp/agent` install fails

57// with "Executable doesn't exist" the moment it tries to launch a test.

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L48

58async function ensureBrowsersInstalled() {

59 if (process.env.CUTLERY_SKIP_BROWSER_INSTALL === "1")

60 return;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L46

61 // Containers (our Docker image) bake browsers into the layer — skip the check.

62 if ((0, fs_1.existsSync)("/.dockerenv"))

63 return;

64 try {

65 if ((0, fs_1.existsSync)(playwright_1.chromium.executablePath()))

66 return;

67 }

68 catch { /* path lookup failed — fall through to install */ }

Lines 290-330javascript

290program

291 .command("example")

292 .description("Create an example test case JSON file")

293 .argument("[output]", "Output file path", "example-test.json")

294 .action((output) => {

295 const { writeFileSync } = require