registry / openspec-playwright / 0.3.48

openspec-playwright@0.3.48

OpenSpec + Playwright E2E verification setup tool for Claude Code

Static Scan Results

scanned 23h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 28 file(s), 177 KB of source

Source & flagged code

3 flagged

dist/utils/mcp-tools.jsView file

Lines 1-25javascript

1/**

2 * Shared utilities for Playwright MCP tool synchronization.

3 * Parses @playwright/mcp README to extract browser_* tool names and

4 * updates the Healer MCP tools table in SKILL.md.

5 */

6import { execSync } from 'child_process';

7import { existsSync, readFileSync, writeFileSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/utils/mcp-tools.jsView on unpkg · L5

8import { join } from 'path';

9import chalk from 'chalk';

10/** Cached directory for npm temp files */

11const TMP_DIR = '/tmp/openspec-pw-mcp';

12/**

13 * Get the latest @playwright/mcp version from npm registry.

14 * Falls back to cached README if network fails.

15 */

16function getLatestVersion() {

17 try {

18 const json = execSync('npm show @playwright/mcp version --json', { stdio: 'pipe', encoding: 'utf-8' }).trim();

19 return JSON.parse(json);

20 }

21 catch {

22 return '0.0.68'; // fallback to known version

23 }

24}

25/**

dist/commands/mcpSync.jsView file

Lines 54-94javascript

54 const before = noMarkers.slice(0, start);

55 const after = noMarkers.slice(end);

56 return before + buildHealerTable(version, tools) + after;

57}

58/** Fetch latest @playwright/mcp version from npm registry */

dist/commands/coverage.jsView file

Lines 258-298javascript

258 return collected;

259}

260function collectMarkdownFiles(dir, collected = []) {

261 if (!existsSync(dir))

262 return collected;

263 const entries =

Source & flagged code

3 flagged · loading source

dist/utils/mcp-tools.jsView file

5*/ L6: import { execSync } from 'child_process'; L7: import { existsSync, readFileSync, writeFileSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/utils/mcp-tools.jsView on unpkg · L5

dist/commands/mcpSync.jsView file

74} L75: const execAsync = promisify(exec); L76: /** Extract a .tgz tarball to a destination directory (cross-platform) */

High

Shell

Package source references shell execution.

dist/commands/mcpSync.jsView on unpkg · L74

dist/commands/coverage.jsView file

278try { L279: const result = execFileSync("npx", ["openspec", "list", "--json"], { L280: shell: needsShell,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/coverage.jsView on unpkg · L278

Findings

3 High3 Medium4 Low

HighChild Processdist/utils/mcp-tools.js

HighShelldist/commands/mcpSync.js

HighRuntime Package Installdist/commands/coverage.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

3 flagged

dist/utils/mcp-tools.jsView file

Lines 1-25javascript

1/**

2 * Shared utilities for Playwright MCP tool synchronization.

3 * Parses @playwright/mcp README to extract browser_* tool names and

4 * updates the Healer MCP tools table in SKILL.md.

5 */

6import { execSync } from 'child_process';

7import { existsSync, readFileSync, writeFileSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/utils/mcp-tools.jsView on unpkg · L5

8import { join } from 'path';

9import chalk from 'chalk';

10/** Cached directory for npm temp files */

11const TMP_DIR = '/tmp/openspec-pw-mcp';

12/**

13 * Get the latest @playwright/mcp version from npm registry.

14 * Falls back to cached README if network fails.

15 */

16function getLatestVersion() {

17 try {

18 const json = execSync('npm show @playwright/mcp version --json', { stdio: 'pipe', encoding: 'utf-8' }).trim();

19 return JSON.parse(json);

20 }

21 catch {

22 return '0.0.68'; // fallback to known version

23 }

24}

25/**

dist/commands/mcpSync.jsView file

Lines 54-94javascript

54 const before = noMarkers.slice(0, start);

55 const after = noMarkers.slice(end);

56 return before + buildHealerTable(version, tools) + after;

57}

58/** Fetch latest @playwright/mcp version from npm registry */

dist/commands/coverage.jsView file

Lines 258-298javascript

258 return collected;

259}

260function collectMarkdownFiles(dir, collected = []) {

261 if (!existsSync(dir))

262 return collected;

263 const entries =