T08 · Insecure Dependencies
Error
- Location
- SKILL.md:6
- Finding
- Runtime Execution of an Unpinned npm Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 6; vulnerable commands are also documented at lines 14, 24-30, 36-50, and 58-78 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: High ### Vulnerable Code ```yaml allowed-tools: ["Bash(npx awal@latest status*)", "Bash(npx awal@latest auth *)", "Bash(npx awal@latest balance*)", "Bash(npx awal@latest address*)", "Bash(npx awal@latest show*)"] ``` Examples of the permitted runtime execution documented in `SKILL.md` include: ```bash npx awal@latest auth login <email> npx awal@latest auth verify <flowId> <otp> npx awal@latest status ``` ### Technical Analysis The skill authorizes and repeatedly instructs the Agent to execute `awal@latest` through `npx`. The npm `latest` distribution tag is mutable and does not identify a fixed, previously reviewed package version. Depending on the local npm environment, `npx` can retrieve the package and execute its entry point at runtime. Consequently, the code that ultimately runs can change after the skill has been audited. The skill provides no package-version pin, lockfile, integrity hash, provenance check, or controlled installation process. This is particularly sensitive because the package is used for wallet authentication and receives email addresses, authentication flow IDs, and one-time passwords. This finding does not establish that the current `awal` package is malicious. The vulnerability is the trust placed in mutable third-party code at execution time, which creates a supply-chain attack path if the package, publisher account, npm distribution channel, or mutable tag is compromised. ### Attack Path 1. An attacker compromises the `awal` package publisher, publishing workflow, or another component capable of updating the npm `latest` tag. 2. The attacker publishes a malicious release and causes `awal@latest` to resolve to that release. 3. A user or Agent invokes the authentication skill. 4. The skill executes a command su ...[truncated 1231 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace `awal@latest` with an exact, reviewed version, for example: ```bash npx --no-install awal status ``` Install the exact version separately through a controlled deployment process: ```bash npm install --save-exact awal@<reviewed-version> ``` 2. Commit and enforce a lockfile so that both direct and transitive dependency versions remain reproducible. 3. Verify npm package integrity and provenance during installation. Restrict installation to an approved registry and validate package signatures or trusted publishing provenance where supported. 4. Avoid downloading executable dependencies during wallet authentication. Preinstall the reviewed CLI in a hardened build or deployment stage, then use `npx --no-install` or a fixed local executable path at runtime. 5. Review every dependency update before deployment. Use automated dependency scanning, package allowlists, and change-control approval for updates affecting authentication or wallet operations. 6. Run the wallet CLI in a least-privilege sandbox with restricted filesystem, environment-variable, subprocess, and network access. 7. Minimize exposure of authentication secrets. Prefer having the user provide the OTP explicitly rather than granting mailbox access, avoid logging OTPs or flow IDs, and clear sensitive values immediately after verification. ]]>