T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:43
- Finding
- Unpinned npm Package Is Downloaded and Executed Automatically## Vulnerability Details **File Location**: `SKILL.md`, lines 43–49 **Vulnerability Type**: Insecure third-party dependency execution **Risk Level**: Medium **Vulnerable Code**: ```bash npx -y @larksuite/whiteboard-cli@^0.2.11 \ -i diagram.mmd -o diagram.png -f mermaid npx -y @larksuite/whiteboard-cli@^0.2.11 \ -i diagram.mmd --to openapi --format json \ | lark-cli whiteboard +update \ ``` ### Technical Analysis The documented workflow uses `npx -y` to download and execute `@larksuite/whiteboard-cli` automatically. The caret version constraint `^0.2.11` permits npm to select compatible releases newer than the version reviewed. No lockfile, package integrity hash, vendored artifact, or other immutable dependency control is present in the audited project. As a result, the effective executable code may change after this Skill has been reviewed. Automatic confirmation through `-y` further removes an opportunity for the operator to inspect the package and resolved version before execution. This creates a software supply-chain risk if the package, maintainer account, publication process, or a subsequently accepted release is compromised. ### Attack Path 1. An attacker compromises the npm package, a maintainer account, or another part of its release pipeline. 2. The attacker publishes a malicious version that satisfies `^0.2.11`. 3. An agent follows the documented workflow and invokes `npx -y`. 4. npm resolves and downloads the malicious compatible release. 5. Package installation hooks or the package executable run under the agent user's account. 6. The payload accesses resources available to that process or alters the generated data before it is piped into `lark-cli`. ### Impact Assessment Malicious package code would execute with the privileges of the user running the Skill. Depending on the execution environment, this could permit access to readable project files, environment variables, locally available ...[truncated 244 chars]
- Remediation
- ## Remediation Suggestions - Replace `@^0.2.11` with an audited exact version rather than a semver range. - Declare the package in a project manifest and commit the generated lockfile, including registry integrity metadata. - Install dependencies using a frozen or reproducible mode that rejects lockfile changes. - Avoid ad hoc automatic package execution through `npx -y`. - Verify the package source, publisher, resolved version, and integrity before installation. - Disable dependency lifecycle scripts where feasible, or explicitly audit every required lifecycle script. - Run diagram rendering in a sandbox with minimal filesystem access, restricted network access, and no unnecessary credentials in the environment. - Keep Whiteboard credentials out of the rendering process and expose them only to the narrowly scoped upload step. - Review and validate the generated OpenAPI JSON before submitting it through `lark-cli`.