T08 · Insecure Dependencies
Warning
- Location
SKILL.md:23- Finding
Unpinned Remote Browser Dependencies Permit Mutable Third-Party Code Execution
- Content
View full analysis
` automatically. ``` The primary loading instructions use an unversioned remote script: ```html ``` The complete-page example also loads the unversioned runtime and imports an unpinned package: ```html ``` ```tsx import "@tailwindcss/browser"; ``` Additional examples repeat the unversioned production and development URLs: ```html ``` ```html ``` ### Technical Analysis The recommended runtime URL does not identify an immutable package version and does not use Subresource Integrity. The Skill also automatically rewrites bare package names to CDN URLs and presents dependency version pinning as optional. Consequently, the code reviewed by a developer may differ from the code later returned by the CDN. A compromised CDN account, compromised upstream package, malicious mutable release, or unexpected package-resolution change could cause generated pages to execute altered JavaScript. The browser treats the retrieved module as active code in the page context. The import-map examples at lines 107–108 and 125–129 constrain major versions such as React 18, but they do not pin exact immutable releases. They also do not protect the main `module-tsx` loader with a fixed version or integrity hash. ### Attack Path 1. A user asks the agent to create a build-free TypeScript or TSX page. 2. The a ...[truncated 1333 chars]- Remediation
View remediation