T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:8
- Finding
- Runtime Execution of an Unpinned Third-Party npm Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:8,22-26` **Vulnerability Type**: Unpinned third-party dependency executed through `npx` **Risk Level**: Medium ### Vulnerable Code ```yaml allowed-tools: - Bash(npx @canonry/aeo-audit@4 *) ``` ```markdown Always use the published package: ```bash npx @canonry/aeo-audit@4 "<url>" [flags] --format json ``` ``` ### Technical Analysis The Skill authorizes and directs the agent to execute `@canonry/aeo-audit` dynamically through `npx`. The package reference `@canonry/aeo-audit@4` selects a compatible release from major version 4 rather than an exact, integrity-verified artifact. If the package is not already installed, `npx` can retrieve it from the configured npm registry and execute it immediately. The effective executable payload can therefore change after this Skill has been reviewed. This repository contains only `SKILL.md` and does not include the package implementation, a lockfile, or an integrity hash that would permit verification of the executed code. This is a supply-chain exposure rather than evidence that the current package is malicious. It is nevertheless security-relevant because the downloaded CLI executes with the agent process's local permissions and may receive URLs, filesystem paths, report files, and environment variables such as `PAGESPEED_API_KEY`. The reference to `169.254.169.254` at `SKILL.md:195` is not an instruction to access a cloud metadata endpoint. It documents that redirects or sitemap entries targeting a different private host must remain blocked. That text is an SSRF mitigation and is not a separate vulnerability. ### Attack Path 1. An attacker compromises the npm publisher account, registry delivery path, or another component of the package's release process. 2. The attacker publishes a malicious release compatible with the `@4` package selector. 3. The agent follows the Skill instructions and invokes: ```bash npx @canonry/aeo-audit@4 "<url>" [fla ...[truncated 1193 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the major-version selector with a reviewed exact version, for example: ```bash npx --no-install @canonry/aeo-audit@4.x.y "<url>" --format json ``` Use the actual approved version in place of `4.x.y`. 2. Declare the package in a committed dependency manifest and lockfile. Install dependencies in a controlled build step using: ```bash npm ci --ignore-scripts ``` Permit lifecycle scripts only if they have been explicitly reviewed and are required. 3. Verify package integrity through the committed lockfile and the registry integrity digest. For higher-assurance environments, mirror the approved package artifact in a trusted internal registry. 4. Avoid downloading executable dependencies at Skill invocation time. Execute only the preinstalled, integrity-verified package binary. 5. Run the audit CLI in a sandbox with: - Read-only access to project files unless a confirmed fix operation requires writes. - No access to unrelated home-directory files or credential stores. - A minimal environment containing only variables required for the selected mode. - Network egress restricted to the target site and explicitly required APIs. - No elevated operating-system privileges. 6. Do not expose `PAGESPEED_API_KEY` unless Lighthouse mode is explicitly requested. Use a narrowly scoped key with quota and service restrictions, and ensure it is not included in logs or generated reports. 7. Review each dependency update before changing the pinned version, including package ownership, published files, lifecycle scripts, dependency changes, and provenance metadata. ]]>