T08 · Insecure Dependencies
- Location
SKILL.md:9- Finding
Unpinned npm Package Is Downloaded and Executed at Runtime
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 9–11; additional occurrences at lines 16, 19, 29, 50, and 53
Vulnerability Type: Runtime execution of an unpinned third-party dependency
Risk Level: HighVulnerable Code
yaml allowed-tools: - "Bash(npx agnic@latest status*)" - "Bash(npx agnic@latest balance*)"The same unsafe package reference is used throughout the Skill:
bash npx agnic@latest balance npx agnic@latest status --json npx agnic@latest balance [--network <network>] [--json] npx agnic@latest balance --json npx agnic@latest balance --network base --jsonTechnical Analysis
The Skill instructs the Agent to execute
agnic@latestthroughnpx. Unless already available in a suitable local cache,npxcan retrieve the current package release from the npm registry and execute its package entry point. Thelatesttag is mutable and does not identify a specific, previously reviewed artifact.Consequently, the code executed by this Skill can change after the Skill itself has been audited. The project contains no lockfile, exact package version, integrity hash, vendored implementation, or other mechanism that establishes which
agnicpackage contents will run.This creates a supply-chain trust boundary in which compromise of the npm publisher account, registry distribution path, package repository, or a future release can turn an apparently read-only balance operation into arbitrary code execution. Because npm package lifecycle behavior and executable entry points run under the invoking user's context, malicious package code would inherit the Agent process's available permissions.
Attack Path
- An attacker compromises the
agnicnpm publisher, its release pipeline, or another component capable of updating the package'slatestdistribution tag. - The attacker publishes a malicious release and assigns it to
latest. - A user asks the Agen ...[truncated 1520 chars]
- An attacker compromises the
- Remediation
View remediation
Remediation Suggestions
- Replace
agnic@latestwith an exact, reviewed version, for exampleagnic@1.2.3. Do not use mutable npm tags or version ranges for executable dependencies. - Install dependencies through a committed lockfile and use a reproducible installation command such as
npm ci. - Verify npm integrity metadata and provenance in the deployment pipeline. Record the reviewed package version and artifact hash.
- Prefer a locally installed, locked executable over runtime package retrieval. Configure the allowed command to invoke that local binary.
- Review the package source, executable entry point, lifecycle scripts, transitive dependencies, ownership history, and release process before approval.
- Disable or restrict npm lifecycle scripts where operationally possible.
- Run the command in a sandbox with minimal filesystem and network access. Expose only the credentials needed for the requested balance operation.
- Do not place authentication tokens directly in command-line arguments, because they may appear in process listings or shell history. Supply them through a protected credential mechanism or narrowly scoped environment injection.
- Use a short-lived, least-privileged token and prevent the balance command from inheriting unrelated secrets.
- Replace