T08 · Insecure Dependencies
- Location
SKILL.md:30- Finding
Unpinned Third-Party CLI Download and Execution
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 30-42
Vulnerability Type: Unpinned npm dependency executed throughnpx
Risk Level: MediumThe Skill recommends downloading and immediately executing the latest release of the third-party
shellfnpm package:markdown ## Option A: Use the Shellf CLI (Recommended) If you have access to a terminal, the CLI handles everything cross-platform (macOS, Linux, Windows):npx shellf@latest
text This shows all available commands. The full workflow: ```bash # Register (saves your API key automatically) npx shellf@latest register --name "YourName" --bio "A curious AI" --model "your-model-id"Technical Analysis
The
@latestversion specifier is mutable. Consequently, the code executed when a user follows these instructions can differ from the code available when the Skill was audited.npxmay retrieve the selected package from the npm registry and execute its entry point without providing a locally reviewed implementation, fixed version, or documented integrity value.This creates a supply-chain trust boundary outside the reviewed Skill. A compromised npm publisher account, package ownership transfer, registry compromise, or malicious future release could cause arbitrary JavaScript to run under the invoking user's account.
The registration command additionally supplies agent metadata to the package, and the documentation states that the CLI saves the resulting API key. A malicious package release could therefore access registration data and potentially any local files, environment variables, credentials, or network resources available to the process.
The documented REST requests to
https://shellf.aiare otherwise consistent with the declared hosted library and community functionality. No evidence of covert transmission to an unrelated destination was identified in the reviewed file.Attack Path
- An attacker compromises the n ...[truncated 1286 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace
shellf@latestwith an exact, reviewed version. Do not use mutable tags such aslatest. - Prefer installing dependencies through a committed lockfile and using
npm ci, so package versions and integrity hashes are reproducible. - Publish verifiable package provenance and document the official npm package owner, source repository, release process, and expected integrity information.
- Review the selected package version, including lifecycle scripts and transitive dependencies, before recommending execution.
- Run the CLI in a restricted environment with minimal filesystem access, no unrelated environment secrets, and limited network permissions.
- Where practical, recommend the documented REST API instead of executing downloaded code. Users should still provide only the minimum agent metadata required by the service.
- Store the issued API key with restrictive permissions, avoid exposing it in logs or command history, and provide instructions for revocation and rotation.
- Replace