T08 · Insecure Dependencies
Error
- Location
- SKILL.md:35
- Finding
- Unpinned Third-Party Package Executed with Access to Authenticated Browser Sessions## Vulnerability Details **File Location**: `SKILL.md`, lines 35–41 **Vulnerability Type**: Insecure third-party dependency execution **Risk Level**: High ```json "command": "npx", "args": [ "chrome-devtools-mcp@latest", "--autoConnect" ] ``` ### Technical Analysis The configuration instructs `npx` to execute `chrome-devtools-mcp@latest`. The mutable `latest` tag does not identify a fixed, previously reviewed artifact. A future invocation can therefore download and execute a package version whose contents differ from the version originally audited. The configuration provides no exact version pin, lockfile, integrity hash, or other package-verification mechanism. This creates a supply-chain exposure: compromise of the package, its publisher account, or its release process could cause attacker-controlled code to execute under the user's account. The package is especially sensitive because `--autoConnect` connects it to the local Chrome DevTools endpoint. As documented elsewhere in the Skill, this interface can enumerate and control tabs, read page contents and Outlook messages, fill fields, click controls, and capture screenshots. The dependency consequently operates across a high-trust boundary involving authenticated browser sessions. ### Attack Path 1. An attacker compromises the package publisher, package registry entry, or release process for `chrome-devtools-mcp`, or causes an unsafe release to become the package's `latest` version. 2. The user installs or restarts the configured OpenClaw gateway. 3. `npx` resolves `chrome-devtools-mcp@latest`, downloads the altered release, and executes it with the user's operating-system privileges. 4. The process automatically connects to Chrome's local remote-debugging endpoint at `127.0.0.1:9222`. 5. The malicious process enumerates open tabs and accesses authenticated browser contexts. 6. It can read sensitive page content, capture screenshots, manipulate web applications, or transmit accessible data using ...[truncated 916 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `chrome-devtools-mcp@latest` with an exact, reviewed version; do not use mutable tags or version ranges. 2. Use a lockfile and a deterministic installation process where supported. 3. Verify package provenance, publisher identity, release signatures, and registry integrity metadata before installation and upgrades. 4. Cache or vendor a reviewed artifact and validate its cryptographic hash before execution. 5. Establish a controlled update process in which new versions are reviewed and tested before deployment. 6. Run the MCP server under a dedicated, least-privileged operating-system account or sandbox with restricted filesystem and network access. 7. Use a dedicated Chrome profile containing only the sessions required for the requested task. Do not expose unrelated personal, administrative, financial, or corporate sessions through the debugging endpoint. 8. Enable remote debugging only while actively required, bind it exclusively to localhost, and disable it after use. 9. Limit the MCP server's available browser targets and capabilities where technically possible, and monitor package and browser-control activity for unexpected access.