T08 · Insecure Dependencies
- Location
SKILL.md:9- Finding
Execution of an Unpinned Third-Party npm Package
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 9-11
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: MediumVulnerable Code
yaml allowed-tools: - "Bash(npx agnic@latest status*)" - "Bash(npx agnic@latest email *)"The same mutable package reference is used throughout the documented commands, including:
bash npx agnic@latest status --json npx agnic@latest email setup --display-name "My Agent" --json npx agnic@latest email address --json npx agnic@latest email inbox --limit 10 --json npx agnic@latest email send --to <address> --subject "<subject>" --body "<body>" npx agnic@latest email reply --message-id <id> --body "<reply text>"Technical Analysis
The Skill authorizes direct execution of
agnic@latestthroughnpx. Thelatestnpm distribution tag is mutable, so the code executed during a future invocation is not necessarily the code that existed when the Skill was audited. The project provides neither a fixed package version nor lockfile integrity metadata.If the package publisher, npm account, release pipeline, package namespace, or registry resolution path is compromised, an attacker could publish a malicious version under the
latesttag. A subsequent Skill invocation could download and execute that version with the privileges and environment of the Agent process.This risk is particularly relevant because the CLI handles authentication and email operations. Its process may receive
AGNIC_TOKENthrough the environment or command line and may process email addresses, subjects, message bodies, inbox contents, and message identifiers.Attack Path
- An attacker compromises the
agnicnpm publisher account, package release pipeline, or another relevant dependency-distribution component. - The attacker publishes a malicious release and assigns it to the mutable
latesttag. - A user as ...[truncated 1154 chars]
- An attacker compromises the
- Remediation
View remediation
Remediation Suggestions
- Replace
agnic@latestwith a specifically reviewed and approved version, such asagnic@X.Y.Z. - Install the package as a project dependency using a lockfile that records exact transitive versions and registry integrity hashes.
- Invoke the locally installed, locked binary rather than allowing
npxto resolve and download a package dynamically on every use. - Verify npm package ownership, release provenance, signatures or attestations, and integrity before approving upgrades.
- Perform dependency and package-content review whenever the pinned version is changed.
- Run the CLI in a restricted environment with minimal filesystem permissions, a network allowlist, and only the environment variables required for the requested operation.
- Supply
AGNIC_TOKENthrough a scoped secret manager and avoid the--tokencommand-line option, which may expose the token through process listings or shell history. - Use a narrowly scoped, revocable token where supported, and rotate it immediately if package compromise is suspected.
- Replace