T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:4
- Finding
- Unpinned Third-Party Package Execution Through npx## Vulnerability Details **File Location**: `SKILL.md`, line 4 **Vulnerability Type**: Unpinned runtime dependency execution **Risk Level**: Medium **Vulnerable Code:** ```yaml allowed-tools: Bash(agent-browser:*), Bash(npx agent-browser:*) ``` ### Technical Analysis The Skill explicitly permits execution of `npx agent-browser` without requiring an exact package version, a lockfile integrity value, or a previously reviewed local installation. Depending on the environment and local cache state, `npx` can download a package from an external package registry and execute its lifecycle or runtime code. Consequently, the code executed when the Skill is invoked can differ from the code that existed during this audit. A compromised publisher account, registry compromise, malicious future package release, dependency confusion condition, or package-name takeover could introduce arbitrary code into the agent environment. This is an insecure dependency and supply-chain exposure. The available evidence does not establish that the current `agent-browser` package is malicious; the vulnerability is the authorization of mutable, unpinned code retrieval and execution. ### Attack Path 1. An attacker compromises the package publisher, distribution channel, or one of the package's transitive dependencies. 2. The attacker publishes a malicious release under the package name resolved by `npx agent-browser`. 3. An agent loads this Skill and invokes the permitted `npx agent-browser` command. 4. `npx` retrieves or resolves the attacker-controlled package version. 5. Package lifecycle scripts or runtime code execute with the privileges of the agent process. 6. The malicious package can access files, environment variables, credentials, and network resources available to that process. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the operating-system account running the agent. The accessible scope cou ...[truncated 358 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `Bash(npx agent-browser:*)` from the allowed tools. 2. Install `agent-browser` as a reviewed local dependency rather than downloading it during Skill execution. 3. Pin the dependency and all transitive dependencies to exact versions in a committed lockfile. 4. Verify package integrity through lockfile hashes or an approved artifact repository. 5. Disable package lifecycle scripts during installation unless they have been independently reviewed and are required. 6. Use a private or allowlisted package registry with provenance verification. 7. Run the tool in a restricted environment with minimal filesystem, credential, and network access. 8. Establish a controlled dependency-update process that requires security review before changing the pinned version.