T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:64
- Finding
- Unpinned Third-Party CLI Installation and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 64–75 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```bash npm i @aiagenta2z/onekey-gateway ``` ```bash export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key ``` ```shell npx onekey publish <unqiue_id> <flags> ### Quick Example npx onekey publish craftsman-agent/craftsman-agent --title "My 3D Design" --files "/user/local/my_folder/room_output.glb" ``` ### Technical Analysis The Skill instructs users or agents to install `@aiagenta2z/onekey-gateway` without specifying an exact version, lockfile, or package integrity value, and subsequently invokes its `onekey` executable through `npx`. Because dependency resolution is mutable, the package version installed at execution time may differ from the version that existed when the Skill was audited. An npm package can execute code through installation lifecycle scripts and through its CLI entry point. The resulting process may inherit the configured `DEEPNLP_ONEKEY_ROUTER_ACCESS` credential and the invoking agent's filesystem permissions. The publishing examples at lines 84–87 and 114–123 additionally pass local asset paths to this executable. Access to those explicitly selected files is expected for the declared publishing function, and the audited Skill does not itself demonstrate unauthorized exfiltration. The vulnerability is the lack of controls ensuring that the downloaded executable is a known, reviewed artifact. ### Attack Path 1. An attacker compromises the npm package publisher, publishing account, or distribution chain for `@aiagenta2z/onekey-gateway`. 2. The attacker releases a malicious package version under the same package name. 3. An agent follows line 64 and installs the package without an exact version or verified integrity value. 4. Malicious code runs through an npm lifecycle script or when `npx onekey publish` is invoked. 5. The process inherits the agent's operat ...[truncated 927 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to a specific, reviewed version rather than installing the latest package implicitly: ```bash npm install --save-exact @aiagenta2z/onekey-gateway@<reviewed-version> ``` 2. Commit a lockfile containing registry-resolved integrity metadata and use deterministic installation: ```bash npm ci ``` 3. Verify the package's provenance, publisher identity, signatures or attestations, and integrity before execution. 4. Disable npm lifecycle scripts where compatible with the package: ```bash npm ci --ignore-scripts ``` 5. Avoid allowing `npx` to download missing packages implicitly. Invoke the locally installed, pinned binary and use options that prevent automatic installation where supported. 6. Run the publishing process in a sandbox or container with: - Read access limited to explicitly approved upload files. - No access to unrelated user files or credentials. - A narrowly scoped marketplace token. - Restricted outbound network access limited to required service endpoints. - A non-privileged operating-system account. 7. Document the expected package version, checksum, authorized network destinations, and required filesystem access so future audits can verify the complete execution boundary.