T08 · Insecure Dependencies
- Location
SKILL.md:139- Finding
Unpinned CLI Package Is Downloaded and Executed Before Authenticated Operations
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:139-142
Vulnerability Type: Unpinned third-party dependency and mutable supply-chain execution
Risk Level: MediumVulnerable Code Snippet:
markdown 1. Install and update CLI - Install or upgrade globally: `npm install -g @agentrade/cli@latest`. - Run one-off without global install: `npx @agentrade/cli@latest <command>`. - Verify installed version: `agentrade --version`. - Default policy: update to the latest CLI before execution, especially before write commands (`tasks create|intend|submit|terminate`, `submissions confirm|reject`, `disputes open|respond|vote`, `agents profile update`, `feedback submit`, `system settings ...`).The same unsafe recommendation is mirrored in
SKILL_cn.md:139-142.Technical Analysis
The Skill instructs the agent to resolve and execute the mutable
latestrelease of@agentrade/cli. Neither an exact version nor a reviewed integrity hash is specified. The project also contains no lockfile or other mechanism that binds this runtime installation to a known artifact.npm install -ginstalls package code globally with the invoking user's privileges.npx @agentrade/cli@latestcan download and execute newly published code directly. Consequently, the code executed during a Skill invocation can differ from the code that existed when the Skill was audited.The recommendation to update immediately before write commands increases exposure because the newly downloaded package is then used with bearer tokens, wallet credentials, and potentially an administrator service key. A malicious or compromised package release could read accessible files, intercept command inputs, alter API requests, or perform additional operations under the agent's identity.
Attack Path
- An attacker compromises the npm publisher account, package release process, or another relevant package-distribution component.
- The attacker ...[truncated 1648 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace
@latestwith an exact, reviewed version such as@agentrade/cli@x.y.z. - Do not automatically upgrade immediately before authenticated write operations. Separate dependency promotion from operational execution.
- Verify package provenance, publisher identity, registry source, signatures or attestations, and integrity hashes before approving a release.
- Use a lockfile and reproducible installation process where the runtime environment supports them.
- Prefer a locally installed, previously reviewed binary over ad hoc
npxretrieval. - Avoid global installation unless it is operationally necessary. Install into a dedicated restricted environment instead.
- Run the CLI in a sandbox or container with minimal filesystem access and only the network destinations required for Agentrade.
- Provide bearer tokens, administrator keys, and wallet material only to a verified CLI version and only for the duration of the required operation.
- Restrict credential file permissions and keep unrelated secrets outside the CLI process's readable filesystem.
- Document an explicit version-upgrade review process, including package-diff inspection and testing before the new version is permitted to perform writes.
- Replace