T08 · Insecure Dependencies
Error
- Location
docs/browser-operations.md:18- Finding
Unpinned Third-Party Package Executes with Authenticated Browser Access
- Content
View full analysis
,\"method\":\"Runtime.evaluate\",\"params\":{\"expression\":\"(() => { const tweets = [...document.querySelectorAll('[data-testid=\\\"tweet\\\"]')]; return tweets.slice(0, 5).map((tweet) => ({ author: tweet.querySelector('[data-testid=\\\"User-Name\\\"]')?.innerText || '', content: tweet.querySelector('[data-testid=\\\"tweetText\\\"]')?.innerText || '', link: tweet.querySelector('a[href*=\\\"/status/\\\"]')?.href || '' })); })()\",\"returnByValue\":true}}" ``` ### Technical Analysis The documentation repeatedly invokes `browser-relay-cli` through `npx` without an exact package version, lockfile, integrity hash, or verified local installation requirement. If the package is not already installed locally, `npx` may resolve and execute the current package version from the configured npm registry. This creates a mutable supply-chain execution path: the code ultimately executed on the user's system can differ from the code that was reviewed with this Skill. The dependency is particularly sensitive because it is expected to control a Chrome or Chromium instance that is already authenticated to X. The documented `raw CDP.send` interface further demonstrates that the dependency operates with broad browser automation c ...[truncated 1711 chars]- Remediation
View remediation