T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:40
- Finding
- Unpinned Third-Party Dependencies Are Installed and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 40-45 **Vulnerability Type**: Unpinned dependency installation and supply-chain exposure **Risk Level**: Medium ### Vulnerable Code ```bash ### 2. First-Time Setup (once only) ```bash python3 -m venv ~/browser-use-env source ~/browser-use-env/bin/activate pip install browser-use playwright langchain-openai playwright install chromium ``` ``` ### Technical Analysis The setup instructions install `browser-use`, `playwright`, and `langchain-openai` without pinning reviewed versions or verifying cryptographic hashes. `pip` therefore resolves whichever compatible package versions and transitive dependencies are available at installation time. The `playwright install chromium` command similarly downloads a browser component without an explicit revision or integrity policy in the Skill. Python package installation and subsequent imports can execute package-controlled code with the privileges of the user running the Skill. Package popularity and open-source availability do not establish the integrity of future releases, transitive dependencies, or the configured package index. This creates exposure to compromised package releases, compromised transitive dependencies, dependency confusion where the package index configuration permits it, and malicious changes introduced after the Skill was reviewed. ### Attack Path 1. An attacker compromises a named package, one of its transitive dependencies, or a package-distribution account or index used by the environment. 2. The attacker publishes a malicious version that remains compatible with the unconstrained installation command. 3. A user follows the Skill's first-time setup instructions. 4. `pip install browser-use playwright langchain-openai` resolves and downloads the attacker-controlled release. 5. Malicious behavior executes during installation or when the generated automation script imports and uses the installed package. 6. The payload run ...[truncated 566 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Create a reviewed lock file containing exact versions for all direct and transitive Python dependencies. 2. Record cryptographic hashes and install with an integrity-enforcing command such as: ```bash python3 -m pip install --require-hashes -r requirements.lock ``` 3. Configure an explicit trusted package index rather than inheriting potentially unsafe user-level index settings. 4. Pin the Playwright release and corresponding browser revision, and verify downloaded browser artifacts where supported. 5. Review dependency updates before changing the lock file, including transitive dependency changes and package provenance. 6. Run browser automation in a least-privileged environment or sandbox with access only to files and credentials required for the task. 7. Retain the virtual environment per reviewed release rather than resolving fresh package versions each time. ]]>