T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:42
- Finding
- Unpinned Third-Party Package Installation and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 42-89; additional occurrences at lines 195 and 211 **Vulnerability Type**: Supply-chain risk caused by unpinned dependencies **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g chrome-devtools-mcp ``` ```bash npx -y chrome-devtools-mcp@latest ``` ```json { "mcpServers": { "chrome-devtools": { "command": "npx", "args": ["-y", "chrome-devtools-mcp@latest", "--no-usage-statistics"] } } } ``` ```json { "mcpServers": { "chrome-devtools": { "command": "npx", "args": ["-y", "chrome-devtools-mcp@latest", "--slim", "--headless", "--no-usage-statistics"] } } } ``` ```bash /plugin marketplace add ChromeDevTools/chrome-devtools-mcp /plugin install chrome-devtools-mcp ``` ```yaml mcp: servers: chrome-devtools: command: npx args: ["-y", "chrome-devtools-mcp@latest", "--no-usage-statistics"] ``` Additional unpinned executions include: ```bash npx @puppeteer/browsers install chrome@stable npx -y chrome-devtools-mcp@latest --headless ``` ### Technical Analysis The documented installation and configuration procedures execute third-party packages without pinning them to reviewed, immutable versions. The global npm installation implicitly resolves the current registry version, while several configurations explicitly request `@latest`. The plugin installation and `@puppeteer/browsers` command are similarly not tied to a reviewed version. The `npx -y` option automatically accepts installation without an interactive confirmation step. Consequently, the code executed on a future invocation may differ from the code that existed when this skill was audited. Package lifecycle scripts may also execute during installation. This creates a supply-chain trust boundary in which compromise of the package, npm account, registry resolution, plugin marke ...[truncated 1791 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `@latest`, `@stable`, and implicit latest-version resolution with exact, reviewed versions, for example: ```bash npx --yes chrome-devtools-mcp@<reviewed-exact-version> --no-usage-statistics ``` 2. Pin transitive dependencies with a committed lockfile where installation occurs through a managed project rather than ad hoc global execution. 3. Verify downloaded packages using registry integrity metadata, checksums, signatures, or provenance attestations. Store expected verification data in a reviewed configuration. 4. Avoid global package installation. Install dependencies in an isolated project or controlled container using an unprivileged account. 5. Avoid automatic mutable dependency installation during MCP startup. Preinstall and review a fixed artifact, then configure the MCP server to invoke that local artifact. 6. Configure an approved registry or internal artifact mirror and enforce package allowlists. 7. Disable or strictly control npm lifecycle scripts where compatible with the package. 8. Pin plugin marketplace sources and plugin versions to reviewed revisions or immutable release artifacts. 9. Run the MCP server and Chrome in a sandbox with a dedicated browser profile, minimal filesystem access, restricted environment variables, and no unnecessary credentials. 10. Establish a controlled update process in which new versions are reviewed, scanned, tested, and explicitly approved before changing the pin.