T08 · Insecure Dependencies
Error
- Location
- SKILL.md:48
- Finding
- Unpinned Third-Party Package Is Dynamically Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 48-60 **Vulnerability Type**: Unpinned runtime dependency execution **Risk Level**: High **Vulnerable Code**: ```shell uvx zai-tts -t "{msg}" -o {tempdir}/{filename}.wav uvx zai-tts -f path/to/file.txt -o {tempdir}/{filename}.wav ``` ```shell uvx zai-tts -t "{msg}" -o {tempdir}/{filename}.wav --speed 1.5 uvx zai-tts -t "{msg}" -o {tempdir}/{filename}.wav --speed 1.5 --volume 2 ``` ```shell uvx zai-tts -t "{msg}" -o {tempdir}/{filename}.wav --voice system_002 ``` ### Technical Analysis The skill repeatedly invokes `uvx zai-tts` without specifying an exact package version, lockfile, artifact hash, or other integrity constraint. `uvx` can resolve and execute the third-party package at runtime. Consequently, the code executed by future invocations may differ from the package version that was originally reviewed. If the package distribution account, package repository, release process, or dependency chain is compromised, an attacker can publish malicious executable code under a version that is automatically resolved by `uvx`. The downloaded process inherits the invoking user's privileges and can potentially access the filesystem, network, and environment variables, including `ZAI_AUDIO_TOKEN`. ### Attack Path 1. An attacker compromises the package publisher, package repository, or a transitive dependency used by `zai-tts`. 2. The attacker publishes a malicious package version containing installation-time or runtime code. 3. A user or Agent follows the skill instructions and runs `uvx zai-tts` without a version constraint. 4. `uvx` resolves and executes the attacker-controlled release. 5. The malicious code operates with the invoking process's permissions and may read credentials, access local files, transmit data, or modify the system. ### Impact Assessment Successful exploitation can result in arbitrary code execution with the privi ...[truncated 354 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Pin `zai-tts` to a specific, reviewed version in every command. - Use a lockfile and require cryptographic hashes for the package and its transitive dependencies. - Verify that the package registry publisher and source repository correspond to the intended project. - Establish a controlled update process in which new versions are reviewed before deployment. - Run the package in a restricted sandbox with minimal filesystem access, constrained network access, and no unnecessary environment variables. - Provide the Z.ai credential only to the component that requires it rather than exposing the complete parent environment. - Monitor package provenance and verify signed releases where supported. ]]>