T08 · Insecure Dependencies
- Location
SKILL.md:19- Finding
Unpinned Mutable Third-Party Dependency Installation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:19-32; additional occurrence atCONTRIBUTING.md:23-26
Vulnerability Type: Unpinned third-party package and source installation
Risk Level: HighVulnerable code in
SKILL.md:19-32:bash npm install -g agent-browser agent-browser install agent-browser install --with-depsbash git clone https://github.com/vercel-labs/agent-browser cd agent-browser pnpm install pnpm build agent-browser installAdditional vulnerable code in
CONTRIBUTING.md:23-26:bash npm install -g agent-browser@latestTechnical Analysis
The installation instructions retrieve and execute mutable third-party content without pinning an audited npm package version, Git commit, checksum, or cryptographic signature. The explicit use of
@latestguarantees that the installed artifact can change independently of this Skill's reviewed contents. Cloning the repository's default branch creates the same issue because the referenced branch can be modified after the audit.Installing the npm package may execute package lifecycle scripts. The subsequent
agent-browser install,pnpm install, andpnpm buildcommands also execute code obtained from external package registries or the mutable upstream repository. The global npm installation expands the potential effect to the user's global Node.js environment.This finding does not establish that the current upstream package is malicious. It establishes that the reviewed Skill does not provide a reproducible trust boundary and that future or compromised upstream content could execute without a corresponding change to this repository.
Attack Path
- An attacker compromises the upstream npm publisher account, package release process, dependency tree, or Git repository.
- The attacker publishes a malicious
agent-browserrelease, modifies the default Git branch, or compromises a transitive depend ...[truncated 1156 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin
agent-browserto an explicitly reviewed version, for exampleagent-browser@X.Y.Z, rather than using an implicit current version or@latest. - Pin source-based installation to a full audited Git commit hash instead of the repository's mutable default branch.
- Publish and verify cryptographic checksums or signatures for downloaded artifacts before installation or execution.
- Use a committed lockfile with integrity metadata for all Node.js and pnpm dependencies, and require immutable or frozen-lockfile installation.
- Avoid global installation where possible. Install the dependency in an isolated project, container, sandbox, or dedicated low-privilege environment.
- Disable npm lifecycle scripts during dependency retrieval when feasible, review required scripts separately, and execute them only after verification.
- Document the exact trusted package version, repository commit, expected checksum, Node.js version, and installation procedure in
SKILL.md. - Replace the recommendation to install
@latestinCONTRIBUTING.mdwith a pinned, audited version and a controlled update process. - Run browser automation without administrative privileges and restrict access to unrelated credentials, authentication state, and sensitive local files.
- Pin