T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:47
- Finding
- Unverified Third-Party npm Package Retrieval and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 47-69 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```markdown **Command not found** — the CLI isn't on `PATH`. Work down this list before giving up: 1. **Run it without installing.** The CLI ships in the npm package and needs Node 18+: ```bash npx -y -p plan-to-eat-mcp@0.7.3 plan-to-eat --version # x-release-please-version ``` Note the `-p`. The package exposes two bins, and the one named `plan-to-eat-mcp` — what plain `npx plan-to-eat-mcp` resolves to — is the **MCP server**, which will sit and wait on stdio. `-p plan-to-eat-mcp plan-to-eat` is what selects the CLI. If this works, prefix every command in this skill the same way. 2. **Install it properly.** Faster than `npx` per call, and puts `plan-to-eat` on `PATH`. **Show the user this rather than running it yourself** — it writes outside the working directory: ```bash npm i -g plan-to-eat-mcp@0.7.3 # x-release-please-version ``` 3. **Working from a clone?** `node <repo>/dist/cli/main.js --version`. If `dist/` is missing, the build step was skipped — `npm install && npm run build` in the repo, then retry. 4. **Node missing entirely** (`node --version` fails) — stop and tell the user; don't install a runtime for them. Keep the version pinned in whichever of these you pass on. `npx -y` and a bare `npm i -g` run whatever the registry serves at that moment, so an unpinned command picks up every future publish silently. Releases are published from CI with npm trusted publishing, so each tarball carries a SLSA provenance attestation binding it to the source repository and the commit it was built from; `npm audit signatures` checks the copy that actually got installed. ``` ### Technical Analysis The Skill directs the Agent to use `npx -y` to retrieve and immediately execute the third-party `plan-to-eat-mcp` npm package when the CLI is unavailable. Although the pack ...[truncated 2828 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not automatically run `npx -y` when the CLI is missing. Require explicit user approval before downloading or executing third-party code. 2. Prefer an administrator-installed and previously reviewed `plan-to-eat` executable. 3. Make provenance and signature verification mandatory rather than informational. Verify the package before invoking its CLI, and abort if verification fails. 4. Use a lockfile or reviewed deployment artifact that pins the complete transitive dependency graph. 5. Where supported, verify the downloaded package against an independently published cryptographic digest. 6. Install dependencies in an isolated, least-privileged environment rather than globally or under an account with access to unrelated sensitive files. 7. Avoid exposing account credentials to package installation and verification steps. Provide the Plan to Eat environment variables only to the final reviewed executable and only when required. 8. Disable npm lifecycle scripts during package acquisition where feasible, inspect the package, and permit scripts only after review. 9. Keep the existing prohibition against autonomously performing global installation, and explicitly warn users that global installation executes third-party package code outside the project directory. ]]>