sandbox-npm-install
Pass
Audited by Gen Agent Trust Hub on Mar 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script executes
npm installornpm cito manage Node.js dependencies within the sandbox environment. - [COMMAND_EXECUTION]: Uses
sudoto install system-level dependencies for Playwright when passwordless sudo access is available. This is a standard requirement for the Playwright browser automation tool to function in Linux environments. - [EXTERNAL_DOWNLOADS]: Downloads npm packages and Playwright browser binaries from official registries and Microsoft's hosting infrastructure.
- [SAFE]: Implements secure handling for
.npmrcfiles by restricting permissions to owner-only (chmod 600) and ensuring they are stored in a local directory that is not synced back to the host system. - [SAFE]: Includes validation logic to ensure the temporary installation directory remains within the intended base path (
/home/agent/project-deps), preventing potential path traversal issues.
Audit Metadata