T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:44
- Finding
- Execution of an Unverified Third-Party npm Dependency## Vulnerability Details **File Location**: `SKILL.md`, lines 44-49 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Vulnerable code:** ```bash CLI alternative (pin 0.9.0): ```bash npm install @anima-labs/cli@0.9.0 --save-exact npx anima init ``` ``` ### Technical Analysis The skill directs users to download, install, and execute the third-party npm package `@anima-labs/cli`. Pinning the package to version `0.9.0` improves reproducibility, but it does not authenticate the package contents or establish that the dependency has been security-reviewed. No package source, lockfile integrity record, checksum, signature, or restricted execution procedure is included in the audited project. npm installation can execute package lifecycle scripts, while `npx anima init` directly runs code supplied by the dependency. Such code ordinarily inherits the invoking user's access to local files, environment variables, credentials, and network resources. The dependency implementation was not included in the project and therefore could not be audited. This finding identifies the unsafe dependency execution path; it does not establish that the referenced package is currently malicious. ### Attack Path 1. A user or agent follows the documented CLI alternative. 2. `npm install` retrieves version `0.9.0` and its transitive dependencies from the configured npm registry. 3. npm may execute lifecycle scripts supplied by those packages during installation. 4. The user runs `npx anima init`, executing the downloaded package with the user's privileges. 5. If the package, a transitive dependency, the registry account, or the resolution environment is compromised, attacker-controlled code can access resources available to the invoking process. ### Impact Assessment A compromised dependency could read or modify files accessible to the current user, inspect environment variables and locally available secrets, make ...[truncated 357 chars]
- Remediation
- ## Remediation Suggestions - Require explicit user approval immediately before installing or executing the CLI. - Publish or reference auditable source code for the exact CLI release. - Provide a lockfile containing integrity metadata for the package and all transitive dependencies. - Document the expected registry and prevent dependency resolution through untrusted registry configuration. - Verify a signed release artifact or documented cryptographic checksum before execution. - Where feasible, install with lifecycle scripts disabled and enable only specifically reviewed scripts. - Run initialization in a sandbox with minimal filesystem access, a restricted environment, no unrelated credentials, and limited outbound network access. - Prefer documented API requests when they can perform the task without installing executable third-party code.