T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:35
- Finding
- Runtime Execution of a Mutable Third-Party Dependency## Vulnerability Details **File Location**: `SKILL.md`, lines 35–44 **Vulnerability Type**: Insecure third-party dependency execution through `npx` **Risk Level**: Medium ### Vulnerable Code ```markdown ## Command Format **CRITICAL — Every command MUST follow this EXACT format. Do NOT modify the command prefix.** ```bash npx @midscene/web@1 --bridge <subcommand> [args] ``` - `--bridge` flag is **MANDATORY** here — it activates Bridge mode to connect to the user's desktop Chrome browser ``` The same mutable command pattern is used by the invocation examples at lines 76, 82, 92–96, and 102. ### Technical Analysis The Skill requires execution of `@midscene/web` through `npx`. If the package is not already installed, `npx` can retrieve package content from the configured npm registry and immediately execute it. The dependency selector `@1` identifies only the major release line rather than an exact, audited release. Consequently, any compatible version subsequently published in the 1.x series may become the code executed by this Skill. The project contains no package lockfile, integrity hash, vendored dependency, or verification procedure that establishes an immutable correspondence between the reviewed Skill and the executable dependency. This creates a supply-chain trust boundary: the effective executable payload can change after the Skill has been audited. Exploitation would require compromise or malicious publication within the accepted package or dependency chain; the audit found no evidence that the currently referenced package is itself malicious. ### Attack Path 1. An attacker compromises the package maintainer, registry publication process, or a transitive dependency accepted by a future `@midscene/web` 1.x release. 2. The attacker publishes malicious code in a version satisfying the `@1` selector. 3. An Agent follows the mandatory command format documented by the Skill. 4. `npx` resolves, downlo ...[truncated 1147 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the major-version selector with an exact, reviewed package version. 2. Declare the dependency in `package.json` and commit a lockfile containing registry-resolved integrity metadata. 3. Install dependencies through a reproducible deployment step, such as `npm ci`, rather than allowing runtime retrieval through `npx`. 4. Invoke the locally installed executable, for example through an npm script or `node_modules/.bin`, and prevent implicit package downloads. 5. Verify package provenance and integrity during installation, and use a trusted registry with appropriate publication and access controls. 6. Review and monitor both the direct package and its transitive dependencies before upgrades. 7. Run browser automation in a restricted environment with only the required filesystem and network access. 8. Provide model API credentials with minimal scope and avoid exposing unrelated secrets to the automation process. 9. Require explicit user confirmation before sensitive browser operations, particularly actions involving authenticated accounts, financial transactions, credential changes, or data disclosure.