registry / @qubiqlabs/webpilot / 1.4.0

@qubiqlabs/webpilot@1.4.0

AI-native web automation on top of Playwright: natural language execution, codegen, healing, and reports

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 256 file(s), 1.67 MB of source, external domains: api.anthropic.com, api.openai.com, automationexercise.com, demo.applitools.com, dev.azure.com, dotnet.microsoft.com, en.wikipedia.org, example.com, fonts.googleapis.com, generativelanguage.googleapis.com, github.com, maven.apache.org, nodejs.org, petstore.swagger.io, playwright.dev, www.amazon.com, www.booking.com, www.w3.org, www.wikipedia.org

Source & flagged code

6 flagged

dist/src/core/CodegenPlaywrightValidator.jsView file

Lines 16-56javascript

16 o["default"] = v;

17});

18var __importStar = (this && this.__importStar) || (function () {

19 var ownKeys = function(o) {

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

23 return ar;

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

31 __setModuleDefault(result, mod);

32 return result;

33 };

34})();

35Object.defineProperty(exports, "__esModule", { value: true });

36exports.CodegenPlaywrightValidator = void 0;

37const child_process_1 = require("child_process");

38const fs = __importStar(require("fs"));

High

Child Process

Package source references child process execution.

dist/src/core/CodegenPlaywrightValidator.jsView on unpkg · L36

39const path = __importStar(require("path"));

40const CodegenContext_1 = require("./CodegenContext");

41const CodegenNormalizer_1 = require("./CodegenNormalizer");

42const PromptLoader_1 = require("./PromptLoader");

43const CodegenValidationBundle_1 = require("./CodegenValidationBundle");

44const MAX_PLAYWRIGHT_FIX_ROUNDS = 2;

45function isMissingPlaywrightBrowserError(output) {

46 return /Executable doesn't exist|Please run the following command to download new browsers|npx playwright install/i.test(output);

47}

48/** Playwright CLI args are regex patterns — use project-relative forward-slash paths on Windows. */

49function toPlaywrightSpecArg(relativePath) {

50 return relativePath.replace(/\\/g, '/');

51}

52/**

53 * Runs generated Playwright specs and optionally auto-fixes via LLM from failure output.

54 */

55class CodegenPlaywrightValidator {

56 static runSpecs(relativeSpecPaths) {

dist/src/core/codegen/HistoryReuse.jsView file

Lines 80-120javascript

80 if (doc.isSuccessful === false)

81 return false;

82 if (hasFailureMarkers(doc))

83 return false;

dist/src/integrations/browser_use/PythonRuntime.js#virtual:normalized:round1View file

45const path = __importStar(require("path")); L46: const child_process_1 = require("child_process"); L47: const ProjectContext_1 = require("../../cli/ProjectContext"); ... L57: 'python', L58: ...(process.platform === 'win32' L59: ? ['py -3.13', 'py -3.12', 'py -3.11', 'py'] ... L131: if (process.platform === 'win32') { L132: return ("WebPilot requires Python 3.11+.\n Install from https://www.python.org/downloads/ (or: winget install Python.Python.3.13)\n Or set WEBPILOT_PYTHON to your python.exe path... L133: } ... L136: function projectRoot() { L137: return path.resolve(process.env.WEBPILOT_PROJECT_ROOT || (0, ProjectContext_1.findProjectRoot)()); L138: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/src/integrations/browser_use/PythonRuntime.js#virtual:normalized:round1View on unpkg · L45

dist/src/cli/index.jsView file

Lines 630-670javascript

630 else

631 fail('tsconfig.json missing', 'Init/codegen should scaffold Cypress TypeScript config.');

632 if (exists('cypress/support/pages/BasePage.ts'))

633 pass('cypress/support/pages/BasePage.ts found');

634

scripts/setup-python.shView file

•path = scripts/setup-python.sh kind = build_helper sizeBytes = 1489 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/setup-python.shView on unpkg

docs/FRAMEWORK_GUIDE.mdView file

Lines 682-722markdown

682

683WebPilot codegen follows rules in `resources/prompts/shared/`:

684

685- **Strict semantic locators** — scope regions, use `.filter()` when multiple matches

686- **BasePage reuse** — generated POMs call shared helpers, not raw Playwright everywhere

687- **Multi-page POM** — one class per route, not one file per site

Source & flagged code

6 flagged · loading source

dist/src/core/CodegenPlaywrightValidator.js

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code