T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:34
- Finding
- Unverified Third-Party Package Retrieval and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 34 and 126–248; unsafe upgrade guidance also appears at line 305 **Vulnerability Type**: Supply-chain exposure through mutable npm package references and automatic execution **Risk Level**: Medium ### Vulnerable Code ```markdown Automate web browsing using `npx -y @midscene/web@1`. ``` Representative executable commands include: ```bash npx -y @midscene/web@1 connect --url https://example.com npx -y @midscene/web@1 act --prompt "click the Login button and fill in the email field with 'user@example.com'" npx -y @midscene/web@1 assert --prompt "there is a login button visible" npx -y @midscene/web@1 take_screenshot npx -y @midscene/web@1 report-tool --action to-markdown --htmlPath ./midscene_run/report/.../index.html --outputDir ./output-markdown ``` The troubleshooting section also recommends a mutable version: ```bash npm i @midscene/web@latest @midscene/core@latest @midscene/shared@latest ``` ### Technical Analysis The skill instructs the Agent to use `npx -y`, which can retrieve an npm package and execute its binary automatically without interactive confirmation. The package reference `@midscene/web@1` pins only the major version, not an exact audited release. Consequently, later releases within the accepted version range may be executed without any corresponding review of their contents. The `@latest` upgrade instruction is even less deterministic because the registry can resolve it to any release currently carrying that distribution tag. The project contains no lockfile, integrity metadata, checksum validation, vendored dependency, or installation procedure that separates package review from runtime execution. This creates a supply-chain trust boundary: the code that ultimately executes is determined partly by mutable external npm registry state rather than solely by the audited project. The audit found no evidence that the currently named Midscene packages are malicious; the vulnerab ...[truncated 1847 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every dependency to an exact reviewed version rather than a major range or `latest`, for example: ```bash npm install --save-exact @midscene/web=X.Y.Z ``` 2. Commit a package manifest and lockfile containing registry integrity hashes. Perform installation in a controlled setup phase rather than downloading packages during each skill invocation. 3. Invoke only the previously installed local binary and prohibit network installation at runtime, for example: ```bash npx --no-install midscene-web connect --url https://example.com ``` Use the actual local binary name documented by the pinned package. 4. Remove the recommendation to install `@latest`. Replace it with a documented update process that reviews release notes and package contents, updates to an exact version, regenerates the lockfile, and runs security tests before deployment. 5. In hardened environments, install dependencies from an approved internal registry or artifact repository and verify package provenance, signatures where available, and lockfile integrity. 6. Run browser automation in a least-privilege sandbox with restricted filesystem and network access. Provide only the environment variables needed for the current task. 7. Treat CDP and Bridge sessions as sensitive capabilities. Require explicit user authorization before attaching to an existing browser, isolate automation profiles where possible, and avoid exposing unrelated authenticated tabs.