T08 · Insecure Dependencies
- Location
SKILL.md:14- Finding
Unpinned Runtime Installation of a Third-Party npm Package
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 14-16 and 28-29
Vulnerability Type: Unpinned runtime dependency installation
Risk Level: MediumVulnerable Code
markdown - Node.js with `ws` npm package available at `/tmp/wsclient/node_modules/ws` - Install once: `npm install ws --prefix /tmp/wsclient` - If not found, install before startingmarkdown 1. Install `ws` if needed: `npm install ws --prefix /tmp/wsclient`Technical Analysis
The skill instructs the agent to install the latest package published under the npm name
wsduring execution. The installation command does not specify an exact version, use a lockfile, verify an integrity hash, disable lifecycle scripts, or enforce a trusted registry.Consequently, the code executed by the skill can change after the skill itself has been audited. If the resolved package, its dependency chain, the maintainer account, or the configured npm registry is compromised, installation or subsequent
require()execution may run attacker-controlled code with the privileges of the agent process.The supplied script later imports the dynamically installed module:
javascript const WebSocket = require('/tmp/wsclient/node_modules/ws');The dependency is then used while the process has access to a Chrome Remote Debugging Protocol endpoint. The documentation states that all browser tabs share the same Chrome profile and authenticated cookie session, increasing the potential impact of a supply-chain compromise.
Attack Path
- An attacker compromises the relevant npm publishing account, a transitive dependency, or the registry used by the runtime environment.
- The attacker publishes or serves a malicious version that resolves for the unversioned
npm install wscommand. - The agent follows the skill instructions and installs the dependency into
/tmp/wsclient. - Malicious npm lifecycle code may execute during ...[truncated 1198 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin
wsto a reviewed exact version rather than resolving the latest release:bash npm install --save-exact ws@<reviewed-version> --prefix /tmp/wsclient - Maintain and review a committed lockfile, then use
npm ciinstead of an unconstrained installation. - Disable package lifecycle scripts where they are unnecessary:
bash npm ci --ignore-scripts --prefix /tmp/wsclient - Enforce an approved npm registry and prevent user or project configuration from silently redirecting package resolution to an untrusted source.
- Verify package integrity against a trusted lockfile or independently maintained checksum before loading it.
- Prefer a built-in, previously provisioned, or vendored and reviewed WebSocket implementation so the effective code does not change at runtime.
- Run the skill in a restricted environment with minimal file, process, and network permissions.
- Use a dedicated Chrome profile without unrelated authenticated sessions, and restrict access to the CDP endpoint.
- Use a uniquely created temporary directory with restrictive permissions instead of a predictable shared path, and clean up only the directory created by the current invocation.
- Pin