T08 · Insecure Dependencies
Warning
- Location
SKILL.md:44- Finding
Unverifiable Third-Party npm Package Installation and Execution
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 44–48
Vulnerability Type: Third-party dependency and supply-chain risk
Risk Level: Mediummarkdown CLI alternative (pin 0.9.0): ```bash npm install @anima-labs/cli@0.9.0 --save-exact npx anima inittext ### Technical Analysis The skill instructs the agent to download an external npm package and execute its CLI. Although the package version is pinned to `0.9.0`, the project does not include the package source, a dependency lockfile, cryptographic integrity information, or a reproducible build reference. Consequently, the package's npm lifecycle scripts, transitive dependencies, and runtime behavior cannot be verified from the audited artifact. Exact version pinning reduces unintended version drift, but it does not protect against a compromised npm registry account, a malicious or compromised release at the pinned version, registry infrastructure compromise, or vulnerable transitive dependencies. The `npm install` command can execute package lifecycle scripts, while `npx anima init` explicitly runs package-controlled code. No evidence establishes that `@anima-labs/cli@0.9.0` is malicious. The vulnerability is the skill's instruction to install and execute unauditable third-party code without integrity verification or execution isolation. ### Attack Path 1. An agent follows the CLI setup instructions in `SKILL.md`. 2. `npm install` retrieves `@anima-labs/cli@0.9.0` and its transitive dependencies from the configured npm registry. 3. npm executes any enabled lifecycle scripts supplied by those packages. 4. The agent runs `npx anima init`, executing code controlled by the downloaded package. 5. If the pinned package, a transitive dependency, the publisher account, or the registry delivery channel has been compromised, attacker-controlled code runs with the permissions of the invoking user. 6. That code could access files and environment variab ...[truncated 828 chars]- Remediation
View remediation
Remediation Suggestions
- Provide auditable source code for the CLI or link the pinned release to a reviewed source commit and reproducible build.
- Commit a lockfile that fixes the complete transitive dependency graph.
- Verify registry-provided integrity hashes against trusted, independently published checksums or signed release attestations.
- Document the package's lifecycle scripts, required filesystem permissions, expected network destinations, and data-access requirements.
- Where compatible with the package, install dependencies with lifecycle scripts disabled, such as
npm install --ignore-scripts, and invoke only reviewed entry points. - Run the CLI in a restricted container or sandbox with least-privilege filesystem access, a minimal environment, no unrelated credentials, and outbound network access limited to documented Anima endpoints.
- Avoid running the installation or initialization commands as root or through
sudo. - Perform dependency vulnerability and provenance checks before installation, and repeat those checks when changing the pinned package version or dependency graph.