T08 · Insecure Dependencies
Error
- Location
- SKILL.md:19
- Finding
- Execution of an Unpinned Third-Party npm Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 19-20 **Vulnerability Type**: Supply-chain risk caused by unpinned dependency execution **Risk Level**: High ### Vulnerable Code ```bash npx agnic@latest status --json ``` The same mutable `agnic@latest` package reference is also used by the authentication and logout instructions elsewhere in `SKILL.md`. ### Technical Analysis The skill directs the agent to execute the `latest` release of a third-party npm package through `npx`. If that release is not already available locally, `npx` may download and immediately execute it. The project provides no fixed version, lockfile, package integrity hash, vendored source, or other mechanism that binds execution to the version reviewed during this audit. Consequently, the effective implementation can change without any modification to the audited skill. Compromise of the npm package, its publisher account, or its release process could cause a future invocation to execute attacker-controlled package lifecycle or CLI code under the privileges of the user running the agent. This finding concerns unsafe dependency execution. The audited file itself contains no evidence that the current package release is malicious. ### Attack Path 1. An attacker compromises the npm package publisher, publication credentials, or upstream release process. 2. The attacker publishes a malicious version under the `agnic` package and assigns it the `latest` distribution tag. 3. A user or agent follows the skill and invokes `npx agnic@latest`. 4. `npx` retrieves the mutable release and executes its package or CLI code. 5. The malicious code runs with the invoking user's operating-system privileges and can access resources available to that account. ### Impact Assessment Successful exploitation could permit arbitrary code execution within the invoking user's privilege boundary. Depending on that user's environment and accessible data, the package could read or alter fil ...[truncated 297 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace `agnic@latest` with an exact, reviewed package version in every allowed-tool declaration and command example. 2. Install dependencies through a lockfile-backed workflow and enforce npm integrity verification. 3. Review package provenance, publisher identity, repository ownership, and release signatures before permitting execution. 4. Prefer a locally installed, version-controlled CLI dependency over on-demand `npx` downloads. 5. Update versions only through a controlled review process that re-audits changed package code and dependencies. 6. Where supported, disable automatic installation prompts and fail closed when the approved version is unavailable. ]]>