T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:6
- Finding
- Mutable npm Package Version Is Downloaded and Executed Through npx## Vulnerability Details **File Location**: `SKILL.md`, lines 6-11 and command examples throughout lines 18-102 **Vulnerability Type**: Supply-chain risk caused by execution of an unpinned third-party dependency **Risk Level**: Medium ### Vulnerable Code ```yaml allowed-tools: ["Bash(npx @openant-ai/cli@latest status*)", "Bash(npx @openant-ai/cli@latest login*)", "Bash(npx @openant-ai/cli@latest verify*)", "Bash(npx @openant-ai/cli@latest whoami*)", "Bash(npx @openant-ai/cli@latest agents register*)", "Bash(npx @openant-ai/cli@latest agents heartbeat*)", "Bash(npx @openant-ai/cli@latest wallet *)", "Bash(npx @openant-ai/cli@latest bind-email*)", "Bash(npx @openant-ai/cli@latest logout*)"] ``` ```bash npx @openant-ai/cli@latest status --json ``` ### Technical Analysis The skill executes `@openant-ai/cli` using the mutable npm tag `latest`. An `npx` invocation can download and immediately execute package code when the requested version is not already available locally. The code ultimately executed by this skill can therefore change after the skill itself has been reviewed. The project contains no package lockfile, integrity hash, vendored dependency, or exact version constraint that binds these commands to a reviewed CLI artifact. Although there is no evidence in the audited file that the current package is malicious, this configuration creates a supply-chain exposure: compromise of the package publisher, npm account, package distribution channel, or a future release could affect every documented operation. ### Attack Path 1. An attacker compromises the npm package publisher or otherwise gains the ability to publish or retag `@openant-ai/cli`. 2. The attacker publishes a malicious release and causes the npm `latest` tag to resolve to it. 3. The agent invokes any permitted command, such as `npx @openant-ai/cli@latest status --json`. 4. `npx` retrieves and executes the changed package code. 5. The package executes with t ...[truncated 587 chars]
- Remediation
- ## Remediation Suggestions - Replace `@openant-ai/cli@latest` with an exact, reviewed version, such as `@openant-ai/cli@X.Y.Z`. - Install the dependency through a package manifest and lockfile that records package integrity metadata. - Use a controlled dependency-update process that reviews release changes before updating the pinned version. - Where feasible, install the approved CLI artifact ahead of time rather than permitting `npx` to retrieve executable code during skill invocation. - Consider enforcing an approved registry and validating package provenance or signatures in the deployment pipeline. - Re-audit the dependency whenever its pinned version is changed.