T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:6
- Finding
- Unpinned Third-Party CLI Is Downloaded and Executed Through npx<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 6-100 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium The skill repeatedly invokes the third-party `@openant-ai/cli` npm package through `npx` using the mutable `@latest` tag. ### Vulnerable Code ```yaml allowed-tools: ["Bash(npx @openant-ai/cli@latest status*)", "Bash(npx @openant-ai/cli@latest tasks accept *)", "Bash(npx @openant-ai/cli@latest tasks apply *)", "Bash(npx @openant-ai/cli@latest tasks get *)", "Bash(npx @openant-ai/cli@latest files *)"] ``` Representative command instructions include: ```bash npx @openant-ai/cli@latest status --json npx @openant-ai/cli@latest tasks get <taskId> --json npx @openant-ai/cli@latest tasks accept <taskId> --json npx @openant-ai/cli@latest tasks accept <taskId> --team <teamId> --json npx @openant-ai/cli@latest tasks apply <taskId> --message "I have 3 years of Solana auditing experience. Previously audited Marinade Finance and Raydium contracts." --json npx @openant-ai/cli@latest files list <taskId> --json npx @openant-ai/cli@latest files download <taskId> --all --json npx @openant-ai/cli@latest files download <taskId> --all --output ./task-files/ --json npx @openant-ai/cli@latest files url <taskId> --all --json ``` ### Technical Analysis `npx` can retrieve and execute an npm package on demand. The `@latest` tag does not identify an immutable, reviewed artifact: its target can change whenever a new version is published. Consequently, the code executed when the skill is invoked may differ from the code that existed when the skill was audited. The project contains no exact package version, dependency lockfile, integrity hash, or documented provenance-verification mechanism. The affected CLI is used for authenticated OpenAnt operations, remote state changes, and downloading externally supplied files. Any package lifecycle behavior and transitive dependencies execute with the privileges and environment inherited from ...[truncated 1671 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed package version, for example: ```bash npx --yes @openant-ai/cli@<reviewed-exact-version> status --json ``` 2. Prefer installing the dependency through a committed lockfile that records package and transitive-dependency integrity metadata. Execute the locked local binary instead of resolving a package dynamically for every invocation. 3. Verify npm package provenance, publisher identity, release signatures or attestations, and integrity information before approving an update. 4. Establish a controlled update process: - Review release changes and dependency-tree differences. - Scan the new artifact and its transitive dependencies. - Test it in an isolated environment. - Update the pinned version and lockfile only after approval. 5. Run the CLI in a sandbox or restricted subprocess with only the filesystem paths, environment variables, credentials, and network destinations required for OpenAnt operations. 6. Avoid exposing unrelated secrets to the CLI process. Supply narrowly scoped OpenAnt credentials at execution time and rotate them if a dependency compromise is suspected. 7. Restrict downloaded files to a dedicated directory and treat their contents as untrusted, particularly before opening or executing them. ]]>