T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:1006
- Finding
- Unpinned Package Retrieval and Execution Through npx## Vulnerability Details **File Location**: `SKILL.md`, lines 1006-1007 **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium ### Vulnerable Code ```bash # shadcn/ui (open code, owned components) npx shadcn@latest init npx shadcn@latest add button card badge separator input ``` A related recommendation also appears at line 99: ```markdown | Modern SaaS where you own the components | shadcn/ui (`npx shadcn@latest add ...`) | You own the code, easy to customise; never ship default state | ``` ### Technical Analysis The skill instructs the agent to invoke `npx` with the mutable `latest` distribution tag. If the package is not already present locally, `npx` can retrieve it from the configured npm registry and immediately execute its command-line entry point. Because `latest` does not identify an immutable, previously reviewed release, the effective code executed by this instruction can change after the skill itself has been audited. The instruction does not require an exact version, lockfile validation, package-integrity review, registry verification, or execution in a restricted environment. This creates a supply-chain trust boundary: security depends on the future state of the package, its maintainers, the npm account and registry configuration, and the dependencies resolved at execution time. The audit found no evidence that the referenced package is currently malicious; the vulnerability is the unsafe, unpinned execution pattern. ### Attack Path 1. An attacker compromises the package maintainer account, package release process, npm registry path, or one of the dependencies included in a future release. 2. The attacker publishes malicious or compromised code under the version referenced by the mutable `latest` tag. 3. An agent follows the skill and runs `npx shadcn@latest init` or the subsequent `add` command. 4. `npx` downloads and executes the newly resolved package code. 5. The malicious process runs with the operatin ...[truncated 1108 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the mutable `latest` tag with an exact, reviewed version: ```bash npx --yes shadcn@X.Y.Z init npx --yes shadcn@X.Y.Z add button card badge separator input ``` 2. Document the approved version in the skill and update it only after a security review. 3. Verify package provenance and registry configuration before execution: ```bash npm config get registry npm view shadcn@X.Y.Z version dist.integrity dist.tarball ``` 4. Download and inspect the package before running its entry point when operating in a sensitive environment: ```bash npm pack shadcn@X.Y.Z ``` 5. Preserve and review lockfile changes generated by the command. Use reproducible installation controls such as `npm ci` for subsequent installs. 6. Run scaffolding tools in a sandbox or disposable workspace with: - No production credentials in the environment. - Access limited to the target project directory. - Restricted outbound network access. - No administrative or root privileges. 7. Review all generated files and dependency changes before committing or executing the generated application. 8. Apply the same exact-version policy to every executable package command documented by the skill.