T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:26
- Finding
- Mutable Third-Party npm Package Is Automatically Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md:26`, `SKILL.md:84-164`, `SKILL.md:190-198`, and `SKILL.md:226` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```markdown Automate iOS devices using `npx -y @midscene/ios@1`. ``` Representative commands used throughout the skill include: ```bash npx -y @midscene/ios@1 connect npx -y @midscene/ios@1 runwdarequest --method GET --endpoint /wda/screen npx -y @midscene/ios@1 take_screenshot npx -y @midscene/ios@1 act --prompt "type hello world in the search field and press Enter" npx -y @midscene/ios@1 assert --prompt "there is a login button visible" npx -y @midscene/ios@1 disconnect npx -y @midscene/ios@1 report-tool --action to-markdown --htmlPath ./midscene_run/report/.../index.html --outputDir ./output-markdown ``` The troubleshooting guidance also recommends installing mutable latest releases: ```bash npm i @midscene/ios@latest @midscene/core@latest @midscene/shared@latest ``` ### Technical Analysis The skill repeatedly directs the agent to invoke `npx` with the `-y` option. This option automatically accepts package installation, allowing code obtained from the npm registry to be executed without an interactive confirmation step. The dependency selector `@midscene/ios@1` pins only the major version rather than an exact audited release. It can therefore resolve to different version 1.x releases over time. The recommendation to install packages using `@latest` is even less constrained and can resolve to any release currently associated with the mutable npm distribution tag. The audited project contains only `SKILL.md`; it provides no lockfile, integrity hashes, vendored dependency code, package-signature validation, or other mechanism that binds execution to a previously reviewed artifact. Consequently, the effective code executed by these instructions can change after the skill itself has been reviewed. This is a supply-chain weakness rather than ev ...[truncated 2073 chars]
- Remediation
- ## Remediation Suggestions 1. Replace mutable dependency selectors with exact, reviewed versions: ```bash npx -y @midscene/ios@1.2.3 connect ``` The actual version should be selected only after review; the example version above is illustrative. 2. Prefer installing dependencies in advance with a committed lockfile rather than downloading them at each invocation: ```bash npm ci ./node_modules/.bin/midscene-ios connect ``` 3. Commit `package.json` and `package-lock.json`, and require lockfile integrity verification in deployment and CI workflows. 4. Remove the recommendation to install `@latest`. Upgrades should use an exact proposed version and require dependency review, changelog inspection, and security testing before adoption. 5. Where operationally compatible, install dependencies with lifecycle scripts disabled: ```bash npm ci --ignore-scripts ``` If lifecycle scripts are required, review them explicitly before permitting execution. 6. Run the automation package in a restricted environment with least-privilege filesystem access, minimal environment variables, constrained outbound network access, and no unrelated credentials. 7. Keep API credentials outside the project directory and expose only the credentials required for the current run. Rotate credentials if dependency compromise is suspected. 8. Add package provenance, registry allowlisting, checksum verification, and dependency vulnerability scanning to the package-approval process.