T08 · Insecure Dependencies
Error
- Location
SKILL.md:8- Finding
Execution of an Unpinned, Mutable npm Package with Broad Tool Authorization
- Content
View full analysis
--method GET --json npx agnic@latest trade 10 USDC ETH --json npx agnic@latest send --network base --json npx agnic@latest email send --to user@example.com --subject "Hello" --body "Message" ``` ### Technical Analysis The skill authorizes execution of `npx agnic@latest`, which resolves a mutable package version from the npm ecosystem at invocation time. The reviewed project contains no pinned package version, lockfile, integrity hash, vendored source, or trusted wrapper that would ensure the executed code is the same code that was reviewed. Consequently, publishing a new `latest` release—or compromising the package publisher, registry account, or distribution path—can alter the code executed by the skill without any modification to `SKILL.md`. Because `npx` executes package-provided code locally, a malicious dependency release could run with the operating-system permissions of the agent process. The trailing wildcard in: ```yaml "Bash(npx agnic@latest *)" ``` also authorizes arbitrary arguments and package subcommands rather than limiting access to the documented operations. This increases exposure if the package has undocumented, newly added, or dangerous subcommands. The issue is especially significant because the skill uses the dependency for security-sensitive capabilities: OAuth authentication, stored account access, wallet balances, paid API calls, mainnet token trades, USDC transfers, identity data, email, and AI prompts. The package implementation itself ...[truncated 2241 chars]- Remediation
View remediation