T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:6
- Finding
- Mutable npm Dependency Executed in Cryptocurrency Wallet Workflow## Vulnerability Details **File Location**: `SKILL.md`, line 6 **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: Medium The allowed tool configuration authorizes multiple commands that execute the mutable `latest` release of the OpenAnt npm CLI: ```yaml allowed-tools: ["Bash(npx @openant-ai/cli@latest status*)", "Bash(npx @openant-ai/cli@latest tasks create *)", "Bash(npx @openant-ai/cli@latest tasks fund *)", "Bash(npx @openant-ai/cli@latest tasks list *)", "Bash(npx @openant-ai/cli@latest whoami*)", "Bash(npx @openant-ai/cli@latest wallet *)"] ``` ### Technical Analysis The Skill uses `npx` to resolve, download, and execute `@openant-ai/cli@latest`. The `latest` npm distribution tag is mutable, so the code executed at runtime can differ from the version reviewed during this audit. No exact version, lockfile, package integrity hash, or locally verified binary is specified. This creates a supply-chain trust boundary in which compromise of the npm package, publisher account, release pipeline, or distribution tag could introduce arbitrary code without requiring any modification to `SKILL.md`. The risk is amplified because even nominally read-only operations such as `status` and `wallet balance` execute the package before funded operations are presented for confirmation. The Skill includes appropriate semantic safeguards for financial operations, including requiring confirmation before funding and checking wallet balance first. However, these instructions cannot constrain malicious code inside a compromised npm package once `npx` executes it. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, or another mechanism controlling `@openant-ai/cli`. 2. The attacker publishes a malicious release and assigns it to the mutable `latest` distribution tag. 3. A user invokes the Skill for a legitimate task-creation request. 4. The agent runs an allowed command su ...[truncated 1257 chars]
- Remediation
- ## Remediation Suggestions 1. Replace every `@latest` reference with an exact, reviewed package version, for example `@openant-ai/cli@X.Y.Z`. 2. Install the CLI through a controlled deployment process using a committed lockfile rather than downloading it dynamically during each Skill invocation. 3. Enforce npm integrity verification and retain reviewed package hashes or signed release provenance. 4. Disable install scripts where compatible, and audit the package and its transitive dependencies before upgrades. 5. Update the allowed-tool patterns so they authorize only the pinned executable and the minimum required subcommands. 6. Run the CLI in a sandbox with restricted filesystem, environment-variable, credential, and network access. 7. Separate read-only status operations from transaction-signing capabilities and require an external wallet confirmation that displays the destination, chain, token, amount, and task identifier. 8. Introduce a deliberate dependency-update process in which new versions are reviewed and tested before changing the pinned version.