registry / @qubiqlabs/webpilot / 1.1.3

@qubiqlabs/webpilot@1.1.3

AI-native web automation on top of Playwright: natural language execution, codegen, healing, and reports

Static Scan Results

scanned 17h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 137 file(s), 943 KB of source, external domains: api.anthropic.com, api.openai.com, automationexercise.com, demo.applitools.com, dotnet.microsoft.com, fonts.googleapis.com, generativelanguage.googleapis.com, maven.apache.org, nodejs.org, petstore.swagger.io, www.booking.com, www.w3.org

Source & flagged code

4 flagged

dist/src/core/CodegenPlaywrightValidator.jsView file

Lines 16-56javascript

16 o["default"] = v;

17});

18var __importStar = (this && this.__importStar) || (function () {

19 var ownKeys = function(o) {

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

23 return ar;

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

31 __setModuleDefault(result, mod);

32 return result;

33 };

34})();

35Object.defineProperty(exports, "__esModule", { value: true });

36exports.CodegenPlaywrightValidator = void 0;

37const child_process_1 = require("child_process");

38const fs = __importStar(require("fs"));

High

Child Process

Package source references child process execution.

dist/src/core/CodegenPlaywrightValidator.jsView on unpkg · L36

39const path = __importStar(require("path"));

40const CodegenContext_1 = require("./CodegenContext");

41const CodegenNormalizer_1 = require("./CodegenNormalizer");

42const PromptLoader_1 = require("./PromptLoader");

43const MAX_PLAYWRIGHT_FIX_ROUNDS = 2;

44function isMissingPlaywrightBrowserError(output) {

45 return /Executable doesn't exist|Please run the following command to download new browsers|npx playwright install/i.test(output);

46}

47/** Playwright CLI args are regex patterns — use project-relative forward-slash paths on Windows. */

48function toPlaywrightSpecArg(relativePath) {

49 return relativePath.replace(/\\/g, '/');

50}

51/**

52 * Runs generated Playwright specs and optionally auto-fixes via LLM from failure output.

53 */

54class CodegenPlaywrightValidator {

55 static runSpecs(relativeSpecPaths) {

56 const existing = relativeSpecPaths.filter((p) => fs.existsSync(path.join(process.cwd(), p)));

dist/src/cli/index.jsView file

Lines 547-587javascript

547 else

548 fail('tsconfig.json missing', 'Init/codegen should scaffold Cypress TypeScript config.');

549 if (exists('cypress/support/pages/BasePage.ts'))

550 pass('cypress/support/pages/BasePage.ts found');

551 else

552 fail('BasePage.ts missing'

scripts/setup-python.shView file

•path = scripts/setup-python.sh kind = build_helper sizeBytes = 1224 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/setup-python.shView on unpkg

docs/FRAMEWORK_GUIDE.mdView file

Lines 682-722markdown

682

683WebPilot codegen follows rules in `resources/prompts/shared/`:

684

685- **Strict semantic locators** — scope regions, use `.filter()` when multiple matches

686- **BasePage reuse** — generated POMs call shared helpers, not raw Playwright everywhere

687- **Multi-page POM** — one class per route, not one file per site

688- **Symbol graph merge** — new methods extend existing page classes via AST

Source & flagged code

4 flagged · loading source

dist/src/core/CodegenPlaywrightValidator.jsView file

36exports.CodegenPlaywrightValidator = void 0; L37: const child_process_1 = require("child_process"); L38: const fs = __importStar(require("fs"));

High

Child Process

Package source references child process execution.

dist/src/core/CodegenPlaywrightValidator.jsView on unpkg · L36

dist/src/cli/index.jsView file

567try { L568: execSync('npx tsc --noEmit', { L569: encoding: 'utf8',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/cli/index.jsView on unpkg · L567

scripts/setup-python.shView file

•path = scripts/setup-python.sh kind = build_helper sizeBytes = 1224 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/setup-python.shView on unpkg

docs/FRAMEWORK_GUIDE.mdView file

702patternName = generic_password severity = medium line = 702 matchedText = await ap... });

Medium

Secret Pattern

Hardcoded password in docs/FRAMEWORK_GUIDE.md

docs/FRAMEWORK_GUIDE.mdView on unpkg · L702

Findings

3 High5 Medium4 Low

HighChild Processdist/src/core/CodegenPlaywrightValidator.js

HighShell

HighRuntime Package Installdist/src/cli/index.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/setup-python.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterndocs/FRAMEWORK_GUIDE.md

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/src/core/CodegenPlaywrightValidator.jsView file

Lines 16-56javascript

16 o["default"] = v;

17});

18var __importStar = (this && this.__importStar) || (function () {

19 var ownKeys = function(o) {

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

23 return ar;

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

31 __setModuleDefault(result, mod);

32 return result;

33 };

34})();

35Object.defineProperty(exports, "__esModule", { value: true });

36exports.CodegenPlaywrightValidator = void 0;

37const child_process_1 = require("child_process");

38const fs = __importStar(require("fs"));

High

Child Process

Package source references child process execution.

dist/src/core/CodegenPlaywrightValidator.jsView on unpkg · L36

39const path = __importStar(require("path"));

40const CodegenContext_1 = require("./CodegenContext");

41const CodegenNormalizer_1 = require("./CodegenNormalizer");

42const PromptLoader_1 = require("./PromptLoader");

43const MAX_PLAYWRIGHT_FIX_ROUNDS = 2;

44function isMissingPlaywrightBrowserError(output) {

45 return /Executable doesn't exist|Please run the following command to download new browsers|npx playwright install/i.test(output);

46}

47/** Playwright CLI args are regex patterns — use project-relative forward-slash paths on Windows. */

48function toPlaywrightSpecArg(relativePath) {

49 return relativePath.replace(/\\/g, '/');

50}

51/**

52 * Runs generated Playwright specs and optionally auto-fixes via LLM from failure output.

53 */

54class CodegenPlaywrightValidator {

55 static runSpecs(relativeSpecPaths) {

56 const existing = relativeSpecPaths.filter((p) => fs.existsSync(path.join(process.cwd(), p)));

dist/src/cli/index.jsView file

Lines 547-587javascript

547 else

548 fail('tsconfig.json missing', 'Init/codegen should scaffold Cypress TypeScript config.');

549 if (exists('cypress/support/pages/BasePage.ts'))

550 pass('cypress/support/pages/BasePage.ts found');

551 else

552 fail('BasePage.ts missing'

scripts/setup-python.shView file

•path = scripts/setup-python.sh kind = build_helper sizeBytes = 1224 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/setup-python.shView on unpkg

docs/FRAMEWORK_GUIDE.mdView file

Lines 682-722markdown

682

683WebPilot codegen follows rules in `resources/prompts/shared/`:

684

685- **Strict semantic locators** — scope regions, use `.filter()` when multiple matches

686- **BasePage reuse** — generated POMs call shared helpers, not raw Playwright everywhere

687- **Multi-page POM** — one class per route, not one file per site

688- **Symbol graph merge** — new methods extend existing page classes via AST