T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:66
- Finding
- Unpinned Third-Party Packages Are Installed and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 13, 66–67, and 199–200 **Vulnerability Type**: Supply-chain exposure through unpinned dependencies **Risk Level**: Medium ### Vulnerable Code ```bash pnpm add @vercel/sandbox ``` ```ts await sandbox.runCommand("npm", ["install", "-g", "agent-browser"]); await sandbox.runCommand("npx", ["agent-browser", "install"]); ``` The same installation pattern is used when creating a reusable sandbox snapshot: ```ts await sandbox.runCommand("npm", ["install", "-g", "agent-browser"]); await sandbox.runCommand("npx", ["agent-browser", "install"]); const snapshot = await sandbox.snapshot(); return snapshot.snapshotId; ``` ### Technical Analysis The documented commands do not pin exact versions of `@vercel/sandbox` or `agent-browser`. Package managers can therefore resolve a different release whenever the instructions are followed. The effective code executed by the workflow can change after the Skill has been reviewed, without any corresponding modification to `SKILL.md`. Installing `agent-browser` globally may execute package lifecycle scripts and makes the installed executable available to subsequent sandbox commands. The `npx` invocation then executes package-controlled code and installs browser components. In the snapshot workflow, the resulting software is captured in a reusable VM image, potentially propagating a compromised dependency across later browser-automation runs. This finding concerns unsafe dependency resolution. The audited file contains no evidence that the named packages are currently malicious. ### Attack Path 1. An attacker compromises a package release, maintainer account, transitive dependency, or relevant package-distribution channel. 2. A developer or deployed workflow follows the Skill and installs the package without an exact version or integrity constraint. 3. The package manager resolves the attacker-controlled or compromis ...[truncated 1111 chars]
- Remediation
- ## Remediation Suggestions 1. Pin exact reviewed versions of all packages, including `@vercel/sandbox` and `agent-browser`. 2. Commit and review the appropriate lockfile, and use immutable installation modes such as `pnpm install --frozen-lockfile` or `npm ci`. 3. Replace ambiguous execution commands with explicitly versioned invocations, or invoke a dependency installed from the verified lockfile rather than allowing `npx` to resolve packages dynamically. 4. Verify package provenance and integrity using registry integrity metadata, checksums, signatures, or an approved internal package mirror. 5. Disable unnecessary package lifecycle scripts where operationally possible and review any scripts that must remain enabled. 6. Build production sandbox snapshots only through a controlled CI pipeline using pinned dependencies and reproducible build inputs. 7. Record the exact dependency versions and snapshot build provenance, scan snapshots before publication, and rebuild them promptly when trusted security updates are approved. 8. Apply least privilege and outbound network restrictions to sandbox workloads to reduce the impact of a compromised dependency.