T08 · Insecure Dependencies
- Location
SKILL.md:83- Finding
Automatic Installation and Execution of Untrusted Project Dependencies
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 83–90
Vulnerability Type: Unreviewed third-party dependency installation and execution
Risk Level: MediumComplete Code Snippet
text 3. Start backend (if project has backend, by type): Java: mvn clean package -DskipTests -q ; java -jar target/*.jar Node: npm install ; node server.js Python: pip install -r requirements.txt ; python app.py Go: go build ; ./app After startup, poll /health or /actuator/health or GET root path, up to 60s If none reachable, poll process port (netstat/lsof to confirm port is listening) 4. Start frontend (if project has frontend): npm install (if no node_modules) ; npm run devThe related prerequisite at
SKILL.md, line 348, also permits automatic browser dependency installation:text - `npx playwright install chromium` (auto-install on first run if missing)Technical Analysis
The Skill instructs the Agent to install dependencies declared by the target project and immediately execute project entry points. It does not require dependency review, trusted registries, version and hash verification, lockfile enforcement, lifecycle-script suppression, or execution inside an isolated environment.
npm installmay execute package lifecycle hooks such aspreinstall,install, andpostinstall. Python dependency installation may execute build backend or package setup logic. Maven and Go builds can also retrieve and process remote dependencies or plugins. After installation, commands such asnode server.js,python app.py,npm run dev, and./appdirectly execute repository-controlled code.Although
npx playwright install chromiumordinarily installs browser binaries for Playwright, the instructions do not pin an approved Playwright package version or require a previously verified local installation. Depending on local tool state and package-manager behavior, this can introduce additional mutable supply- ...[truncated 2058 chars]- Remediation
View remediation
Remediation Suggestions
- Require explicit user approval before installing, building, or executing dependencies from an unreviewed target repository.
- Run target projects in an ephemeral, low-privilege container or virtual machine with:
- A read-only host filesystem outside a disposable workspace.
- No host credential mounts or SSH agent forwarding.
- Restricted outbound network access.
- Resource, process, and execution-time limits.
- A non-root user and no privileged container capabilities.
- For Node.js projects:
- Require a reviewed lockfile and use
npm cirather thannpm install. - Initially use
npm ci --ignore-scripts. - Review lifecycle scripts before allowing them in a separate sandbox.
- Configure an approved registry and package allowlist where practical.
- Require a reviewed lockfile and use
- For Python projects:
- Require exact version pins and hashes, such as
pip install --require-hashes -r requirements.txt. - Prefer pre-reviewed wheels from an approved index.
- Disable build isolation or source builds only when doing so is compatible with a trusted, controlled package workflow.
- Require exact version pins and hashes, such as
- For Maven and Go projects:
- Enforce dependency checksum and lock controls.
- Use approved mirrors or proxies.
- Review build plugins, Maven wrapper files, Go directives, and repository-controlled build scripts before execution.
- Pin Playwright tooling to an approved version and install browser assets during preparation of a trusted runner image rather than dynamically during the audit.
- Separate source analysis from execution. Perform static inspection first and stop for approval if manifests, lifecycle hooks, wrappers, plugins, or entry points contain unexpected executable behavior.
- Avoid exposing database credentials or authentication tokens to the application sandbox unless a specific verification step requires them. Use short-lived, least-privilege test credentials when required.