T08 · Insecure Dependencies
- Location
SKILL.md:64- Finding
Unpinned Third-Party CLI Installation and Execution
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 64–75
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: MediumVulnerable Code
bash npm i @aiagenta2z/onekey-gatewaybash export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_keyshell npx onekey publish <unqiue_id> <flags> ### Quick Example npx onekey publish craftsman-agent/craftsman-agent --title "My 3D Design" --files "/user/local/my_folder/room_output.glb"Technical Analysis
The Skill instructs users or agents to install
@aiagenta2z/onekey-gatewaywithout specifying an exact version, lockfile, or package integrity value, and subsequently invokes itsonekeyexecutable throughnpx.Because dependency resolution is mutable, the package version installed at execution time may differ from the version that existed when the Skill was audited. An npm package can execute code through installation lifecycle scripts and through its CLI entry point. The resulting process may inherit the configured
DEEPNLP_ONEKEY_ROUTER_ACCESScredential and the invoking agent's filesystem permissions.The publishing examples at lines 84–87 and 114–123 additionally pass local asset paths to this executable. Access to those explicitly selected files is expected for the declared publishing function, and the audited Skill does not itself demonstrate unauthorized exfiltration. The vulnerability is the lack of controls ensuring that the downloaded executable is a known, reviewed artifact.
Attack Path
- An attacker compromises the npm package publisher, publishing account, or distribution chain for
@aiagenta2z/onekey-gateway. - The attacker releases a malicious package version under the same package name.
- An agent follows line 64 and installs the package without an exact version or verified integrity value.
- Malicious code runs through an npm lifecycle script or when
npx onekey publishis invoked. - The process inherits the agent's operat ...[truncated 927 chars]
- An attacker compromises the npm package publisher, publishing account, or distribution chain for
- Remediation
View remediation
Remediation Suggestions
-
Pin the dependency to a specific, reviewed version rather than installing the latest package implicitly:
bash npm install --save-exact @aiagenta2z/onekey-gateway@<reviewed-version> -
Commit a lockfile containing registry-resolved integrity metadata and use deterministic installation:
bash npm ci -
Verify the package's provenance, publisher identity, signatures or attestations, and integrity before execution.
-
Disable npm lifecycle scripts where compatible with the package:
bash npm ci --ignore-scripts -
Avoid allowing
npxto download missing packages implicitly. Invoke the locally installed, pinned binary and use options that prevent automatic installation where supported. -
Run the publishing process in a sandbox or container with:
- Read access limited to explicitly approved upload files.
- No access to unrelated user files or credentials.
- A narrowly scoped marketplace token.
- Restricted outbound network access limited to required service endpoints.
- A non-privileged operating-system account.
-
Document the expected package version, checksum, authorized network destinations, and required filesystem access so future audits can verify the complete execution boundary.
-