T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:6
- Finding
- Unpinned npm Package Execution in a Cryptocurrency Wallet Workflow## Vulnerability Details **File Location**: `SKILL.md`, lines 6–66 **Vulnerability Type**: Unpinned third-party dependency executed at runtime **Risk Level**: Medium ### Vulnerable Code ```yaml allowed-tools: ["Bash(npx awal@latest status*)", "Bash(npx awal@latest show*)", "Bash(npx awal@latest address*)", "Bash(npx awal@latest balance*)"] ``` ```bash npx awal@latest status npx awal@latest show npx awal@latest address npx awal@latest balance ``` ### Technical Analysis The Skill repeatedly invokes `awal@latest` through `npx`. The `latest` npm distribution tag is mutable, so these commands may download and execute package code that differs from the version present when the Skill was audited. The project does not specify an exact package version, integrity hash, lockfile, reviewed local implementation, or other mechanism that guarantees reproducible execution. Because `npx` can retrieve and execute the package at runtime, compromise of the package publisher, npm account, package ownership, or release process could turn an otherwise legitimate command into arbitrary code execution. This risk is especially significant because the commands interact with a cryptocurrency wallet, expose its public address and balance, and open a funding interface. The trailing command wildcards in `allowed-tools` also broaden the accepted command patterns. Although the documented commands contain no attacker-controlled arguments, narrower exact command authorization would better enforce least privilege. ### Attack Path 1. An attacker compromises the npm publisher account, package ownership, or release pipeline for `awal`. 2. The attacker publishes a malicious release and assigns it to the mutable `latest` distribution tag. 3. The Agent invokes one of the documented commands, such as `npx awal@latest show`. 4. `npx` retrieves and executes the attacker-controlled package version with the Agent process's operating-system privileges. 5. The malicious package can inspect accessible ...[truncated 1101 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `awal@latest` with an exact, reviewed version, for example `awal@X.Y.Z`. 2. Install the dependency through a controlled deployment process rather than downloading it during Skill execution. 3. Commit and enforce a lockfile containing registry-resolved integrity hashes. 4. Verify npm package ownership, provenance attestations, release signatures, and publisher account protections. 5. Mirror or vendor the reviewed package in a trusted internal repository where practical. 6. Run the wallet tooling in a restricted sandbox with minimal filesystem, environment-variable, and network access. 7. Restrict `allowed-tools` to exact required commands and remove trailing wildcards unless arguments are operationally necessary. 8. Require explicit user confirmation before displaying deposit addresses, opening payment interfaces, or initiating financially sensitive operations. 9. Re-audit the dependency before upgrading and use automated supply-chain monitoring to detect ownership changes or unexpected releases.