T08 · Insecure Dependencies
Error
- Location
SKILL.md:10- Finding
Unpinned Third-Party npm Package Is Downloaded and Executed
- Content
View full analysis
[-X ] [-d ] [-q ] [-h ] [--max-amount ] [--json] ``` ```bash npx agnic@latest x402 details npx agnic@latest balance --network base npx agnic@latest x402 pay --json ``` ### Technical Analysis Every command resolves and executes `agnic@latest`. The `latest` tag is mutable, so the effective code executed by the Skill can change after the Skill has been reviewed. The project does not pin an exact package version, provide an integrity hash, include a lockfile, or contain the package source for inspection. If the package, its maintainer account, the npm publishing process, or a transitive dependency is compromised, invoking the Skill can execute attacker-controlled JavaScript with the privileges of the agent process. This is particularly sensitive because the package operates in a context involving authentication credentials, wallet balances, API request contents, and paid blockchain transactions. The network access and payment functionality are necessary for the declared x402 purpose, but dynamically retrieving and executing the newest package release exceeds the minimum privilege and reproducibility needed to provide that functionality. ### Attack Path 1. An attacker compromises the `agnic` npm package, its publisher account, or a transitive dependency. 2. The attacker publishes a malicious version and causes it to resolve through the `latest` tag. 3. A user explicitly invokes the paid-request Skill. 4. `npx agnic@latest` downloads and executes the malicious release. 5. The package runs with the agent proces ...[truncated 910 chars]- Remediation
View remediation
`. 2. Install the dependency through a controlled build process rather than downloading it during each Skill invocation. 3. Commit and enforce a lockfile with package integrity hashes. 4. Review the package and its transitive dependencies before deployment. 5. Use an internal package registry or approved package mirror where practical. 6. Run the CLI in a restricted environment with only the network, filesystem, credentials, and wallet permissions required for the requested operation. 7. Establish a controlled update process that repeats security review before changing the pinned version. ]]>