T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:43
- Finding
- Execution of Unpinned Third-Party Packages in a Wallet-Enabled Environment## Vulnerability Details **File Location**: `SKILL.md:43-55`; additional occurrences in `SKILL.md:99-105`, `README.md:9`, `README.md:24-31`, and `rules/getting-started.md:8-26` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code `SKILL.md:43-55`: ```bash npx agentcash@latest check https://pennyregwatch.com/v1/search ``` ```bash npx agentcash@latest fetch https://pennyregwatch.com/v1/search -m POST -b '{"query":"YOUR SEARCH QUERY","limit":5}' ``` ```bash npx agentcash@latest fetch 'https://pennyregwatch.com/v1/search?query=YOUR%20SEARCH%20QUERY&limit=5' ``` `README.md:9`: ```bash npx skills add ayoubsalem-spec/penny-web-search-skill --all --yes ``` `rules/getting-started.md:8-26`: ```bash npx agentcash@latest balance ``` ```bash npx agentcash@latest discover https://pennyregwatch.com ``` ```bash npx agentcash@latest check https://pennyregwatch.com/v1/search ``` ```bash npx agentcash@latest fetch https://pennyregwatch.com/v1/search -m POST -b '{"query":"current AI agent commerce news","limit":5}' ``` ### Technical Analysis The documentation repeatedly instructs users or agents to execute `agentcash@latest` through `npx`. The `latest` tag is mutable and does not identify a specific reviewed release. If the package publisher account, package registry, release process, or a transitive dependency is compromised, these commands can retrieve and execute code that differs from the code reviewed when this skill was published. The installation command also references a repository without an immutable commit identifier and includes `--yes`, which suppresses interactive confirmation. This reduces the opportunity for a user to inspect unexpected installation behavior. The exposure is particularly significant because AgentCash is expected to operate with an x402-capable funded wallet. Although the audited files contain no embedded m ...[truncated 1929 chars]
- Remediation
- ## Remediation Suggestions 1. Replace every `agentcash@latest` reference with a specific, reviewed version, such as `agentcash@X.Y.Z`. 2. Pin the skill installation source to an immutable release, tag with verified provenance, or commit digest rather than a mutable repository reference. 3. Remove `--yes` from security-sensitive installation examples so users can inspect and approve package and permission changes. 4. Verify package provenance, publisher identity, signatures, and registry integrity before execution. 5. Use lockfiles and integrity hashes where the installation mechanism supports them, including pinning relevant transitive dependencies. 6. Run payment tooling in an isolated environment with minimal filesystem access, restricted environment variables, and limited network permissions. 7. Use a dedicated low-balance wallet with explicit per-transaction and cumulative spending limits. 8. Require human confirmation for wallet signatures and payments, especially when package versions or endpoint pricing have changed. 9. Establish a controlled update process in which new package releases are reviewed and tested before the pinned version is changed in the documentation.