T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:10
- Finding
- Unpinned Third-Party Gateway Dependencies Create a Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:10-15`, `SKILL.md:683-697` **Vulnerability Type**: Unpinned third-party dependencies and implicit retrieval of current package releases **Risk Level**: Medium ### Vulnerable Code ```yaml dependencies: npm: - "@aiagenta2z/onekey-gateway" python: - "ai-agent-marketplace" installation: npm: npm -g install @aiagenta2z/onekey-gateway python: pip install ai-agent-marketplace ``` The installation instructions later repeat the unpinned commands: ```bash npm install @aiagenta2z/onekey-gateway ``` ```bash pip install ai-agent-marketplace ``` The documented CLI examples also use `npx` without specifying a reviewed package version: ```shell npx onekey agent mcp-server-chart/mcp-server-chart generate_area_chart '{}' ``` ### Technical Analysis Neither the npm dependency nor the Python dependency is pinned to an exact reviewed version. No lockfile or package integrity hash is included in the audited project. Consequently, following the installation instructions can install whichever package release the registry currently serves rather than the release originally reviewed by the project author. The Python scripts import `OneKeyAgentRouter` directly from `ai_agent_marketplace`. This dependency receives the access key and complete user payload, making it part of the security boundary: ```python from ai_agent_marketplace import OneKeyAgentRouter ``` Because the implementation of that package is not included in the project, its network destinations and internal handling of credentials and data could not be verified by this audit. This does not prove that the current packages are malicious, but it exposes users to future package compromise, publisher-account compromise, or an unexpectedly incompatible release. ### Attack Path 1. An attacker compromises a dependency publisher account, package registry release process, or a transitive dependency. 2. The attacker publishes a modified release ...[truncated 921 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin both dependencies to exact, reviewed versions rather than version ranges or latest releases. 2. Add lockfiles containing resolved transitive dependency versions. 3. Verify package integrity with registry-supported hashes or a trusted artifact repository. 4. Replace implicit `npx` resolution with an explicitly installed, pinned CLI binary. 5. Review package provenance, publisher identity, release signatures, and installation hooks before deployment. 6. Document the expected gateway domains and enforce outbound network allowlisting where possible. 7. Run the tools in a restricted environment with minimal filesystem access and no unnecessary credentials. 8. Establish an update process in which new dependency versions are audited and tested before the pins are changed. ]]>