T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:190
- Finding
- Unpinned Third-Party Package Is Downloaded and Executed Automatically## Vulnerability Details **File Location**: `SKILL.md`, lines 190-196 **Vulnerability Type**: Unpinned and automatically executed npm dependency **Risk Level**: Medium **Vulnerable code:** ```bash npx --yes @agentteamhq/email@latest --version ``` ```markdown For one-off use, prefix the intended command with `npx --yes`: ``` ```bash npx --yes @agentteamhq/email@latest inbox --unseen ``` ### Technical Analysis The Skill directs the Agent to use `npx --yes` with the mutable `latest` tag. This downloads and executes whichever package release currently resolves as `@agentteamhq/email@latest`, without interactive confirmation, an exact version pin, or an integrity constraint. Consequently, the code executed at runtime can differ from the code that existed when the Skill was reviewed. The mailbox command may run with inherited environment variables, including the configured WildDuck access token, user identifier, message-read token, and API endpoints. Although retrieving the legitimate package is consistent with the Skill's purpose, relying on an unpinned release creates a supply-chain trust boundary. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, or another relevant supply-chain component. 2. The attacker publishes a malicious version that becomes the target of the `latest` tag. 3. A user requests an email operation while the local `at-email` command is unavailable. 4. Following the Skill, the Agent executes: ```bash npx --yes @agentteamhq/email@latest inbox --unseen ``` 5. `npx` downloads and executes the changed package without asking for confirmation. 6. The malicious package runs with the Agent process's local privileges and inherited environment, potentially accessing mailbox credentials and performing actions under the user's mailbox authority. ### Impact Assessment Successful exploitation could permit arbitrary code execution with the privi ...[truncated 475 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed package version: ```bash npx --yes @agentteamhq/email@1.2.3 --version npx --yes @agentteamhq/email@1.2.3 inbox --unseen ``` 2. Document a controlled process for reviewing and updating the pinned version. 3. Verify npm provenance and package integrity before execution where supported. 4. Require explicit user approval before downloading and executing the package for the first time, rather than relying solely on `--yes`. 5. Perform installation or bootstrap checks in an environment that does not expose mailbox credentials. Provide secrets only to the reviewed command performing the requested mailbox operation. 6. Prefer a checksum-verified standalone binary or a dependency installed from a lockfile-controlled deployment process. 7. Pin the persistent global installation command at line 202 to the same reviewed version instead of installing the registry's current default release.