T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:25
- Finding
- Unpinned Third-Party Package Installation and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 25–37 **Vulnerability Type**: Unpinned and automatically executed third-party dependency **Risk Level**: Medium **Category**: T08: Insecure Dependencies ### Vulnerable Code ```bash npm install -g @pzeda/super-browser ``` This installs the executable as: ```bash super-browser ``` Check that the CLI is available: ```bash super-browser --version ``` If a global install is not appropriate, use: ```bash npx -y @pzeda/super-browser --help ``` ### Technical Analysis The installation instructions resolve `@pzeda/super-browser` without specifying an exact reviewed version, lockfile, or package integrity hash. Consequently, each installation can retrieve whichever release the package registry currently identifies as the default version. The global `npm install` command may execute package lifecycle scripts with the privileges of the invoking user. The `npx -y` alternative automatically downloads and executes the resolved package without interactive confirmation. The actual package implementation is not included in the audited project, so its executable code and lifecycle behavior cannot be verified from the available files. This creates a supply-chain trust boundary in which a compromised publisher account, package registry, dependency tree, or future package release could introduce arbitrary executable behavior after this skill has been reviewed. ### Attack Path 1. An attacker compromises the `@pzeda/super-browser` publisher account, package distribution channel, or one of its transitive dependencies. 2. The attacker publishes a malicious version or modifies the version selected by the package registry. 3. A user or agent follows the skill instructions and runs either `npm install -g @pzeda/super-browser` or `npx -y @pzeda/super-browser --help`. 4. The package manager retrieves the unpinned malicious release. 5. Malicious lifecycle scripts or CLI entry-point code execute under the invoking use ...[truncated 978 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the package to an exact version that has been reviewed: ```bash npm install -g @pzeda/super-browser@<reviewed-exact-version> ``` 2. Document and verify the expected npm package integrity digest and registry provenance before installation. 3. Avoid `npx -y` because it retrieves and executes the selected package automatically. Prefer a separately reviewed installation step followed by execution of the installed binary. 4. Review the package's source, published artifacts, lifecycle scripts, and transitive dependency tree before recommending it. 5. Where operationally possible, acquire dependencies with lifecycle scripts disabled and enable only explicitly reviewed installation behavior. 6. Run the browser automation package in a sandbox or isolated user account with minimal filesystem and network permissions. 7. Use a dedicated Chrome profile rather than the user's primary authenticated browser profile, and expose CDP only on a local, access-controlled interface. 8. Establish a controlled update process so new package versions require security review before the pinned version is changed.