T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:62
- Finding
- Unpinned Global Dependency and Unverified Automatic Model Downloads## Vulnerability Details **File Location**: `SKILL.md`, lines 62–64 and 129–133 **Vulnerability Type**: Supply-chain exposure through an unpinned global npm package and automatically downloaded model artifacts **Risk Level**: Medium ### Vulnerable Code ```markdown | `coli` not found | Block. Tell user to run `npm install -g @marswave/coli` first | | `ffmpeg` not found | Warn (WAV files still work). Suggest `brew install ffmpeg` / `sudo apt install ffmpeg` | | Models not downloaded | Inform user: first transcription will auto-download models (~60MB) to `~/.coli/models/` | ``` ```markdown Run `coli asr` with JSON output (to get metadata): ```bash coli asr -j --model {model} "{file}" ``` ``` ### Technical Analysis The skill instructs the user to install `@marswave/coli` globally without specifying an exact reviewed version, lockfile, package-integrity value, or trusted registry. It subsequently directs the agent to execute that globally installed program on a user-selected local audio file. The CLI is also permitted to download speech-recognition models automatically. The skill does not identify the download endpoints, require cryptographic signature or checksum verification, or request explicit approval immediately before network retrieval. Neither the CLI implementation nor the downloaded artifacts are included in the audited project, so their behavior and integrity cannot be established from this package. This creates a supply-chain trust boundary: the effective executable can change after the skill has been reviewed whenever the npm package resolves to a newer release. Installation scripts and transitive dependencies may also execute during npm installation. Automatic model retrieval adds a second external artifact channel; tampered model data could compromise transcription integrity or potentially exercise vulnerabilities in the model parser or runtime. ### Attack Path 1. An attacker compromises the npm pack ...[truncated 2079 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `@marswave/coli` to an exact, reviewed version rather than installing the latest available release. 2. Prefer a project-local dependency managed by a committed lockfile instead of a global installation. 3. Use npm integrity metadata and a trusted, explicitly configured registry. Document the expected package name, version, publisher, and integrity hash. 4. Disable or carefully review npm lifecycle scripts where feasible during installation. 5. Document all model download URLs, versions, expected sizes, and cryptographic SHA-256 or stronger hashes. 6. Verify every downloaded model before loading it. Reject missing, mismatched, or unsigned artifacts. 7. Require explicit user confirmation before the first network download and clearly identify the source, destination, and expected artifact size. 8. Provide an offline installation workflow using preverified model files. 9. Run the transcription CLI with least privilege and, where practical, inside a sandbox that restricts filesystem and network access. 10. Add dependency and artifact update procedures requiring security review before changing pinned versions or hashes.