T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:476
- Finding
- Unpinned Third-Party Package Retrieval and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 476–477 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```bash # Install skill (if applicable) npx molthub@latest install skill-name ``` ### Technical Analysis The review workflow recommends running `npx molthub@latest`, which may retrieve and execute the latest release of a third-party npm package. The package is not pinned to a reviewed version or integrity hash, and the instruction does not require source verification or an isolated execution environment. The `@latest` tag is mutable, so the code executed when a user follows this instruction may differ from the code available when the Skill was audited. Package installation and npm lifecycle behavior can execute arbitrary code with the permissions of the Agent or user running the command. Installing a target Skill is also unnecessary when its files have already been supplied for static review. The instruction therefore exceeds the minimum privileges needed for the Skill's declared static auditing functionality. ### Attack Path 1. An attacker compromises the `molthub` package, its maintainer account, or its distribution channel, or causes an unsafe release to become the package's `latest` version. 2. A user or Agent follows the documented review workflow and runs `npx molthub@latest install skill-name`. 3. `npx` downloads the mutable latest package release from the configured npm registry. 4. The downloaded package or associated lifecycle behavior executes in the local environment. 5. Malicious package code operates with the invoking user's permissions and may access or modify resources available to that account. No compromise of the named package was established during this audit; this is a supply-chain exposure created by unpinned remote execution. ### Impact Assessment If the retrieved package is malicious or compromised, it could execute arbitrary code with the invoking us ...[truncated 601 chars]
- Remediation
- ## Remediation Suggestions 1. Remove third-party installation from the review workflow and audit supplied Skill files directly. 2. If package execution is strictly necessary, replace `@latest` with an exact, previously audited version. 3. Verify the package owner, registry origin, release provenance, and integrity before execution. 4. Use lockfiles and registry-supported integrity hashes where applicable. 5. Disable package lifecycle scripts where feasible, such as by using an installation approach equivalent to `--ignore-scripts`, while recognizing that `npx` execution itself still runs package code. 6. Run the package in a disposable sandbox or container with: - No mounted credentials or secret-bearing home directories. - Read-only access to the target files where possible. - No unnecessary network access. - No elevated operating-system privileges. - A temporary filesystem that is destroyed after review. 7. Require explicit user approval before any network retrieval or third-party code execution. 8. Document the package dependency and required network access in the Skill's compatibility and tool restrictions.