T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Unpinned Third-Party CLI Execution Through a Mutable npm Tag## Vulnerability Details **File Location**: `SKILL.md:5, 10, 29-41` **Vulnerability Type**: Supply-chain risk caused by executing an unpinned npm dependency **Risk Level**: Medium ### Vulnerable Code ```yaml allowed-tools: ["Bash(npx @openant-ai/cli@latest status*)", "Bash(npx @openant-ai/cli@latest upload *)", "Bash(npx @openant-ai/cli@latest tasks submit *)", "Bash(npx @openant-ai/cli@latest tasks withdraw *)", "Bash(npx @openant-ai/cli@latest tasks get *)"] ``` ```markdown Use the `npx @openant-ai/cli@latest` CLI to submit completed work for a task you're assigned to. ``` ```bash npx @openant-ai/cli@latest status --json ``` ```bash npx @openant-ai/cli@latest upload <file-path> --json ``` ### Technical Analysis The skill repeatedly instructs the agent to execute `@openant-ai/cli` through `npx` using the mutable `@latest` distribution tag. The package version and integrity digest are not pinned. When the command is invoked, `npx` may retrieve and execute whichever package release the npm registry maps to `latest` at that moment. Consequently, the effective executable can change after this skill has been reviewed, without any modification to the audited repository. This prevents the audit from establishing that future executions will use the same code. This creates a supply-chain exposure if the package publisher, maintainer account, npm publication process, package itself, or a transitive dependency is compromised. The audit did not establish that the current package is malicious; the vulnerability is the unsafe and non-reproducible dependency execution mechanism. ### Attack Path 1. An attacker compromises the package maintainer account, publication token, release process, or relevant dependency chain. 2. The attacker publishes a malicious version of `@openant-ai/cli` and assigns it to the `latest` tag. 3. An agent invokes this skill and runs an allowed command such as: ```bash npx @openant-ai/cli@latest status --json ``` 4. `npx` r ...[truncated 1111 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed package version in every command and in `allowed-tools`, for example: ```bash npx --yes @openant-ai/cli@1.2.3 status --json ``` 2. Prefer installing the CLI through a controlled dependency workflow with a committed lockfile and verified registry integrity metadata rather than downloading it at invocation time. 3. Pin and review transitive dependencies. Use automated dependency scanning, provenance verification, and package-signature or trusted-publisher validation where available. 4. Test and review each proposed package upgrade before changing the pinned version. Do not automatically track mutable npm tags. 5. Execute the CLI in a least-privilege sandbox with: - Access limited to required deliverable paths. - Minimal environment variables and credentials. - Restricted network destinations. - No access to unrelated repositories, SSH keys, or user configuration. - A non-administrative operating-system account. 6. Update every command example and allowlist entry consistently so that no fallback path continues to invoke `@latest`.