T08 · Insecure Dependencies
Error
- Location
SKILL.md:19- Finding
Unpinned npm Execution and Unverified Browser Extension Create Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
"] } } } ``` 2. Prefer a locked local installation using a committed lockfile and npm integrity metadata. Review the package and transitive dependency changes before upgrading. 3. Avoid suppressing installation confirmation where practical. Separate dependency installation from normal Skill execution so upgrades cannot silently introduce new code. 4. Pin the `fetchproxy` extension to a reviewed release tag and immutable commit hash. Publish cryptographic checksums for release artifacts and document how users can verify them. 5. Provide reproducible extension build instructions and include the reviewed manifest and required permissions in the Skill documentation. 6. Minimize extension permissions to homes.com and the minimum local bridge endpoints needed for operation. Avoid broad host permissions, cookie access, or access to unrelated tabs unless strictly necessary. 7. Recommend a dedicated Chrome profile containing no unrelated authenticated sessions, extensions, or sensitive browsing data. 8. Make authenticated-session use optional for public listing operations. Request an authenticated session only when the user explicitly invokes saved-home or saved-search functionality. 9. Document the categories of browser and account data visible to the MCP server and extension, their network destinations, and whether any data is retained. 10. Add a dependency review and release-verification process covering npm ownership, provenance attestations, automated vulnerability scanning, and extension permission changes. ]]>