T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:74
- Finding
- Unpinned Third-Party Package Installation and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 74–85; execution with file-upload arguments is also demonstrated at lines 94–97 and 124–133 **Vulnerability Type**: Unpinned and unverifiable third-party dependency execution **Risk Level**: Medium ### Vulnerable Code Snippet ```text npm i @aiagenta2z/onekey-gateway ``` ```bash export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key ``` ```shell npx onekey publish <unqiue_id> <flags> ### Quick Example npx onekey publish craftsman-agent/craftsman-agent --title "My 3D Design" --files "/user/local/my_folder/room_output.glb" ``` Additional examples execute the same CLI with local files: ```bash npx onekey publish craftsman-agent/craftsman-agent \ --title "Swimming Boy AI Figurine 3D Model" \ --cover_image "${PROJECT_PATH}/swimming_boy/swimming_boy_3d_preview.webp" \ --files "${PROJECT_PATH}/swimming_boy/swimming_boy_3d_model.glb" ``` ### Technical Analysis The Skill directs users or agents to install `@aiagenta2z/onekey-gateway` without specifying an exact version and then execute its `onekey` CLI. The repository contains no dependency lockfile, integrity hash, vendored source, or implementation that would allow the executed package to be reproduced and reviewed. Because package resolution can select a newer release than the one originally assessed, the effective executable behavior may change after this Skill is reviewed. The process is also expected to receive `DEEPNLP_ONEKEY_ROUTER_ACCESS` through its environment and read local files for upload. Consequently, a compromised or malicious package release would execute in a security-sensitive context. This finding does not establish that the current package is malicious. It identifies a supply-chain weakness created by executing an unpinned and locally unverifiable dependency with access to credentials and selected files. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, or a ...[truncated 1374 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `@aiagenta2z/onekey-gateway` to an exact, reviewed version rather than resolving the latest available release. 2. Commit a lockfile containing registry-resolved integrity hashes and use `npm ci` for reproducible installation. 3. Avoid ad hoc `npx` resolution. Invoke only the dependency installed from the verified lockfile, preferably with settings that prevent automatic retrieval of missing packages. 4. Publish or vendor auditable CLI source and document the expected package provenance, npm registry, cryptographic integrity value, and release-signing process. 5. Review package lifecycle scripts and disable them during installation where they are unnecessary. 6. Provide `DEEPNLP_ONEKEY_ROUTER_ACCESS` only to the narrowly scoped publishing process. Use a short-lived, revocable key with permissions limited to asset publication. 7. Run the CLI in a sandbox or container with access restricted to the explicitly selected upload files, a minimal environment, and only required network destinations. 8. Require explicit confirmation of the complete file list and public-sharing behavior before upload. 9. Document credential rotation and incident-response procedures for suspected package or key compromise.