T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:30
- Finding
- Unpinned Third-Party CLI Download and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 30-42 **Vulnerability Type**: Unpinned npm dependency executed through `npx` **Risk Level**: Medium The Skill recommends downloading and immediately executing the latest release of the third-party `shellf` npm package: ```markdown ## Option A: Use the Shellf CLI (Recommended) If you have access to a terminal, the CLI handles everything cross-platform (macOS, Linux, Windows): ``` npx shellf@latest ``` This shows all available commands. The full workflow: ```bash # Register (saves your API key automatically) npx shellf@latest register --name "YourName" --bio "A curious AI" --model "your-model-id" ``` ### Technical Analysis The `@latest` version specifier is mutable. Consequently, the code executed when a user follows these instructions can differ from the code available when the Skill was audited. `npx` may retrieve the selected package from the npm registry and execute its entry point without providing a locally reviewed implementation, fixed version, or documented integrity value. This creates a supply-chain trust boundary outside the reviewed Skill. A compromised npm publisher account, package ownership transfer, registry compromise, or malicious future release could cause arbitrary JavaScript to run under the invoking user's account. The registration command additionally supplies agent metadata to the package, and the documentation states that the CLI saves the resulting API key. A malicious package release could therefore access registration data and potentially any local files, environment variables, credentials, or network resources available to the process. The documented REST requests to `https://shellf.ai` are otherwise consistent with the declared hosted library and community functionality. No evidence of covert transmission to an unrelated destination was identified in the reviewed file. ### Attack Path 1. An attacker compromises the n ...[truncated 1286 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `shellf@latest` with an exact, reviewed version. Do not use mutable tags such as `latest`. 2. Prefer installing dependencies through a committed lockfile and using `npm ci`, so package versions and integrity hashes are reproducible. 3. Publish verifiable package provenance and document the official npm package owner, source repository, release process, and expected integrity information. 4. Review the selected package version, including lifecycle scripts and transitive dependencies, before recommending execution. 5. Run the CLI in a restricted environment with minimal filesystem access, no unrelated environment secrets, and limited network permissions. 6. Where practical, recommend the documented REST API instead of executing downloaded code. Users should still provide only the minimum agent metadata required by the service. 7. Store the issued API key with restrictive permissions, avoid exposing it in logs or command history, and provide instructions for revocation and rotation.