T08 · Insecure Dependencies
Warning
- Location
references/guide/installation.md:104- Finding
Unpinned Remotely Executed CDN Dependencies
- Content
View full analysis
``` ```html ``` The same examples are duplicated in the aggregate documentation at `llms-full.txt:220-225`. ### Technical Analysis The examples load executable JavaScript from public CDNs without pinning exact versions. The `vue@3` selector permits updates within the Vue 3 release line, while the Element Plus URLs do not specify any version. Consequently, the effective code executed by an application can change after the Skill and application have been reviewed. The examples also omit Subresource Integrity hashes. Browsers therefore have no application-defined cryptographic mechanism to verify that the returned files match a previously reviewed artifact. Although the surrounding documentation recommends version pinning, the directly reusable examples remain unpinned. This is a supply-chain weakness rather than evidence that the current CDN content is malicious. ### Attack Path 1. A developer copies one of the documented CDN examples into an application. 2. A browser requests the unpinned Vue or Element Plus resource when a user visits the application. 3. A compromised upstream package release, CDN account, CDN infrastructure, or depen ...[truncated 847 chars]- Remediation
View remediation
``` The exact URLs and hashes must be generated from and verified against the selected releases. ]]>