T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:6
- Finding
- Unpinned npm Package Is Downloaded and Executed via npx## Vulnerability Details **File Location**: `SKILL.md`, lines 6-18; additional occurrences at lines 25, 55, 62, 80, and 100 **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Code ```yaml allowed-tools: ["Bash(npx @openant-ai/cli@latest status*)", "Bash(npx @openant-ai/cli@latest tasks list *)", "Bash(npx @openant-ai/cli@latest tasks get *)", "Bash(npx @openant-ai/cli@latest tasks escrow *)"] ``` ```markdown Use the `npx @openant-ai/cli@latest` CLI to browse, filter, and inspect tasks on the platform. No write operations — all commands here are read-only. **Always append `--json`** to every command for structured, parseable output. ## Confirm Authentication ```bash npx @openant-ai/cli@latest status --json ``` ``` Further affected commands include: ```bash npx @openant-ai/cli@latest tasks list [options] --json npx @openant-ai/cli@latest tasks get <taskId> --json npx @openant-ai/cli@latest tasks escrow <taskId> --json npx @openant-ai/cli@latest stats --json ``` ### Technical Analysis The skill consistently invokes `npx @openant-ai/cli@latest`. The `latest` tag is mutable and does not identify a fixed, previously audited artifact. Depending on the local npm cache and configuration, `npx` may retrieve the current package release and its transitive dependencies from the npm registry before executing it. Although the skill describes these commands as read-only queries, that restriction applies only to the CLI's intended application-level operations. It does not constrain code in the downloaded npm package, its dependencies, or applicable package lifecycle behavior. A compromised publisher account, malicious release, or compromised transitive dependency could therefore cause arbitrary code to execute with the permissions of the agent process. The command recommended at line 100 also invokes `tasks stats`, which is not covered by the declared `allowed-tools` patterns. This is a configuration inconsistency, a ...[truncated 1590 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed version in every command, for example: ```bash npx --yes @openant-ai/cli@1.2.3 status --json ``` 2. Review the selected release and its transitive dependency tree before approving it. Repeat that review before changing the pinned version. 3. Prefer a locked installation with integrity verification over dynamic execution. Commit an appropriate lockfile and use a deterministic installation process such as `npm ci`. 4. Where operationally practical, configure npm to ignore lifecycle scripts and ensure packages are obtained only from an approved registry. This reduces, but does not eliminate, package execution risk. 5. Execute the CLI in a sandbox with least privilege: - Restrict filesystem access. - Expose only required environment variables. - Avoid passing unrelated credentials into the process. - Limit outbound network access to required OpenAnt endpoints and approved package infrastructure. 6. Update every documented invocation consistently; leaving even one `@latest` occurrence preserves the supply-chain risk. 7. Add the documented `stats` operation to the allowlist only if it is intentionally supported and reviewed. Otherwise, remove that recommendation so the documentation and enforced capabilities remain aligned.