T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:8
- Finding
- Unpinned Third-Party npm Dependency Is Installed and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 8-10 and 46-50 **Vulnerability Type**: Unpinned executable third-party dependency **Risk Level**: Medium ### Vulnerable Code ```yaml dependencies: npm: - "@aiagenta2z/onekey-gateway" installation: npm: npm -g install @aiagenta2z/onekey-gateway ``` ```shell ## install onekey agent gateway npm install @aiagenta2z/onekey-gateway ## CLI to Call API and Symbol List npx onekey agent aiagenta2z/financeagent get_cn_stock_market_shanghai_shenzhen '{"symbol_list": ["SH600519", "SH600036"]}' ``` ### Technical Analysis The Skill directs users to install and execute `@aiagenta2z/onekey-gateway` without specifying an exact audited version. The project contains no package lockfile, integrity hash, vendored implementation, or other mechanism that fixes the dependency to reviewed content. The global installation instruction increases the installation scope. The documented `npx` invocation may also retrieve and execute package content dynamically when the required executable is not already available locally. Consequently, the code executed by users can differ from the code available when the Skill was audited. This is a supply-chain weakness rather than evidence that the named package is currently malicious. Exploitation would require compromise of the package, its publisher, the package registry, or another dependency-resolution mechanism. ### Attack Path 1. An attacker compromises the npm package publisher, registry distribution path, or a transitive dependency. 2. The attacker publishes a malicious version that still satisfies the unpinned package reference. 3. A user follows the Skill instructions and runs `npm install`, the global installation command, or `npx onekey`. 4. npm retrieves the attacker-controlled package version. 5. Malicious lifecycle scripts or CLI code execute with the privileges of the invoking user. 6. The payload can acces ...[truncated 516 chars]
- Remediation
- ## Remediation Suggestions - Pin the dependency to an exact version that has undergone security review. - Include and enforce a lockfile with registry integrity metadata. - Install the package locally rather than globally to reduce its scope. - Invoke only the verified local executable, such as through an offline package-manager execution mode. - Prevent runtime package downloads in production or automated environments. - Use an approved npm registry and verify package provenance, signatures, publisher identity, and integrity hashes. - Review direct and transitive dependencies and enable automated dependency vulnerability monitoring. - Run the CLI as an unprivileged, isolated account with access only to the required credential and network destination.