T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:324
- Finding
- Unpinned Third-Party Package Execution Through npx## Vulnerability Details **File Location**: `SKILL.md`, lines 324–325 **Vulnerability Type**: Unsafe resolution and execution of an unpinned third-party dependency **Risk Level**: Medium **Vulnerable Code Snippet**: ```markdown - "Generate migration: `npx drizzle-kit generate`" - "Run migration: `npx drizzle-kit push`" ``` The same commands are repeated in `SKILL.md` at lines 332–333 and documented again at lines 381–382. ### Technical Analysis The skill instructs AI coding agents to invoke `drizzle-kit` through `npx` without specifying a package version, requiring a lockfile-pinned local dependency, validating package provenance, or using `--no-install`. If `drizzle-kit` is not already installed in the target project, `npx` may resolve and download a package from the configured package registry before executing its code. This makes the effective executable dependent on mutable registry state and local package-manager configuration rather than solely on content reviewed with the skill. A compromised package release, registry configuration, dependency-resolution event, or similarly unsafe supply-chain condition could therefore cause arbitrary package code to run with the coding agent's operating-system privileges. Separately, `drizzle-kit push` applies schema changes directly to the configured database and may cause unintended modification when the environment or connection target has not been reviewed. No evidence was found that this project itself supplies a malicious package or deliberately configures a hostile registry. The risk arises from prescribing unpinned dynamic dependency execution. ### Attack Path 1. A user asks the skill to produce an agent-ready PRD for a project using Drizzle ORM. 2. Following the template, the generated story includes `npx drizzle-kit generate` and `npx drizzle-kit push`. 3. An AI coding agent executes these verification or migration commands. 4. If the package is unavailable locally, `npx` dynamically resolves and may ...[truncated 1067 chars]
- Remediation
- ## Remediation Suggestions 1. Add `drizzle-kit` as an explicitly versioned development dependency and commit the package manifest and lockfile. 2. Execute only the lockfile-resolved local binary, preferably through a reviewed package-manager script. 3. If `npx` remains necessary, use `npx --no-install drizzle-kit ...` so execution fails rather than downloading an undeclared package. 4. Require immutable or tightly constrained dependency versions and verify package provenance and integrity during installation. 5. Run dependency installation with lifecycle scripts disabled where practical, enabling required scripts only after review. 6. Separate migration generation from migration application. Require human review of generated SQL before applying it. 7. Do not prescribe `drizzle-kit push` as a universal verification step. Require explicit confirmation of the target environment and database before execution. 8. Use least-privilege database credentials, prohibit production targets by default, and provide tested backup and rollback procedures. 9. Execute package and migration tooling in an isolated environment with restricted filesystem, secret, and network access.