T08 · Insecure Dependencies
Error
- Location
- SKILL.md:10
- Finding
- Execution of an Unpinned Mutable npm Package## Vulnerability Details **File Location**: `SKILL.md`, lines 10-12; executable command examples also appear at lines 20, 32, 39, 46, 61, and 79 **Vulnerability Type**: Supply-chain risk caused by direct execution of a mutable third-party package version **Risk Level**: High ### Vulnerable Code ```yaml allowed-tools: - "Bash(npx agnic@latest status*)" - "Bash(npx agnic@latest auth *)" ``` Representative executable command: ```bash npx agnic@latest status --json ``` ### Technical Analysis The Skill authorizes and instructs the agent to run `agnic@latest` directly through `npx`. The `latest` npm distribution tag is mutable and can point to a different package release at any time after this Skill has been audited. The project provides no lockfile, package integrity hash, vendored copy, or exact reviewed version constraint. When the command is invoked, `npx` may download and execute code from the npm registry. Consequently, the effective executable payload is controlled by the current state of the external package and its publishing infrastructure rather than by the reviewed project. A compromised package publisher, npm account, release workflow, or dependency chain could introduce arbitrary behavior without requiring any modification to `SKILL.md`. ### Attack Path 1. An attacker compromises the `agnic` npm publisher account, its build or release pipeline, or a transitive dependency. 2. The attacker publishes a malicious release and assigns it to the `latest` distribution tag. 3. A user invokes this Skill to authenticate a wallet, check status, or log out. 4. The agent executes an allowed `npx agnic@latest ...` command. 5. `npx` retrieves and executes the attacker-controlled package under the privileges of the agent user. 6. The malicious package can access data available to that process, potentially including environment variables, wallet authentication material, user files, and network resources. ### Impact Assessment Successful exploitation permits ...[truncated 430 chars]
- Remediation
- ## Remediation Suggestions - Replace `agnic@latest` with an exact, security-reviewed package version, such as `agnic@X.Y.Z`. - Manage the CLI through a committed lockfile and use deterministic installation such as `npm ci`. - Verify package integrity through an approved registry, integrity hashes, signed provenance, or equivalent supply-chain controls. - Review new package versions before updating the pinned version. - Run the CLI with the minimum required operating-system permissions and in an isolated environment where practical. - Restrict access to unrelated environment variables and files before invoking the external CLI. - Configure automated dependency scanning and publisher/provenance verification for future updates.