T08 · Insecure Dependencies
Error
- Location
- SKILL.md:69
- Finding
- Automatic Installation of Mutable and Unreviewed npm Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:69`, `SKILL.md:85`, `SKILL.md:134`, and `SKILL.md:141-149` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: High ### Vulnerable Code At `SKILL.md:69`: ```markdown - Check the npm published version once at the start of the session with `npm view @mallocfeng/chromedev version`. Then check the local CLI version with `chromedev version`. If `chromedev` is missing, the local version command is unavailable, or the npm version is newer than the local version, install the explicit npm version with `npm install -g @mallocfeng/chromedev@<npm-version>`, then continue. Do not repeat this check for every page task unless a command call fails. ``` At `SKILL.md:134`: ```bash WORKSPACE="$(git rev-parse --show-toplevel 2>/dev/null || pwd -P)" cd "$WORKSPACE" && npm install @modelcontextprotocol/sdk ``` At `SKILL.md:141-149`: ```bash REMOTE_VERSION="$(npm view @mallocfeng/chromedev version 2>/dev/null || true)" LOCAL_VERSION="$(chromedev version 2>/dev/null | sed -E 's/^.*@([0-9]+\.[0-9]+\.[0-9]+).*$/\1/' || true)" if [ -z "$REMOTE_VERSION" ]; then echo "Could not read @mallocfeng/chromedev version from npm" elif [ -z "$LOCAL_VERSION" ] || node -e 'const [l,r]=process.argv.slice(1); const a=l.split(".").map(Number); const b=r.split(".").map(Number); process.exit(b[0]>a[0] || (b[0]===a[0] && b[1]>a[1]) || (b[0]===a[0] && b[1]===a[1] && b[2]>a[2]) ? 0 : 1)' "$LOCAL_VERSION" "$REMOTE_VERSION"; then npm install -g "@mallocfeng/chromedev@$REMOTE_VERSION" hash -r 2>/dev/null || true fi ``` ### Technical Analysis The skill instructs the agent to query the public npm registry on each session and automatically install the most recently published `@mallocfeng/chromedev` version whenever the local version is missing or older. Although the resulting installation command contains an explicit version number, that number is dynamically obtained from the registry immediately before installation. I ...[truncated 3366 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace dynamic latest-version installation with a reviewed, fixed version: ```bash npm install --global --ignore-scripts @mallocfeng/chromedev@1.0.6 ``` 2. Verify the selected package artifact against an independently maintained expected integrity hash before installation. Do not derive both the version and trust decision solely from mutable registry metadata. 3. Require explicit user approval before installing or upgrading any dependency. Display the exact package, version, source, requested installation scope, and reason. 4. Avoid global installation. Install dependencies in a dedicated, least-privileged directory or isolated container that cannot modify the user's general command environment. 5. Pin `@modelcontextprotocol/sdk` to a reviewed version and use a committed lockfile with integrity metadata. Prefer `npm ci` over an unconstrained `npm install`. 6. Disable lifecycle scripts during dependency acquisition where compatible: ```bash npm install --ignore-scripts --save-exact @modelcontextprotocol/sdk@<reviewed-version> ``` If lifecycle scripts are required, review them before installation and execute them only in a sandbox. 7. Run the middleware under a restricted account or sandbox with narrowly scoped filesystem and network access. Do not expose the user's normal authenticated browser profile unless that access is necessary and explicitly authorized for the task. 8. Separate update management from page-extraction sessions. Package upgrades should occur through a controlled maintenance process rather than automatically whenever the skill is invoked. 9. Maintain an allowlist of reviewed package versions and fail closed when registry metadata is unavailable, unexpected, or newer than the approved version. ]]>