T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:134
- Finding
- Execution of an Unpinned npm Package Through npx<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 134 **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: Medium ### Vulnerable Code ```bash npx mp-skills --help ``` The same unpinned package is also referenced for environment setup: ```bash npx mp-skills setup ``` ### Technical Analysis The workflow directs the agent or user to invoke the `mp-skills` npm package through `npx` without specifying an audited version, requiring a lockfile, verifying package integrity, or restricting installation to an approved registry. If the package is not already installed locally, `npx` may retrieve and execute the current package version available from the configured npm registry. Consequently, the code executed at audit time can differ from the code executed later. The output of `npx mp-skills --help` is then trusted to identify the locations of `wxa-skills-generate` and `wxa-skills-validate`. The workflow subsequently reads instructions from those resolved locations and executes their `validate.mjs`, `execute.mjs`, and `render.mjs` scripts. This extends trust from an unpinned package to further package-controlled instructions and executable files. No evidence establishes that the current `mp-skills` package is malicious. The vulnerability is the unsafe dependency acquisition and execution model, which creates a supply-chain attack opportunity. ### Attack Path 1. An attacker compromises the upstream `mp-skills` package, its publisher account, the configured package registry, or a dependency included in a future release. 2. The user or agent runs `npx mp-skills --help` or `npx mp-skills setup`. 3. `npx` retrieves and executes the attacker-controlled or unexpectedly modified package version. 4. The compromised package executes code with the privileges of the invoking user. 5. The package can return attacker-controlled generator and validator paths. 6. Following the documented workflow, the agent reads instructions ...[truncated 930 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `mp-skills` to a specific reviewed version rather than resolving the latest available release: ```bash npx mp-skills@<reviewed-version> --help ``` 2. Prefer installing the dependency through a committed lockfile from an approved registry, and then prohibit implicit downloads: ```bash npm ci npx --no-install mp-skills --help ``` 3. Record and verify the expected package integrity hash. Use registry allowlisting, package signatures, or provenance verification where supported. 4. Validate that the resolved generator and validator directories are located under the expected verified package installation directory before reading instructions or executing scripts from them. 5. Do not automatically trust paths printed by package output. Reject absolute or unexpected paths outside the approved installation root and resolve symbolic links before validation. 6. Review and pin the transitive dependency graph. Enable automated dependency scanning and require explicit approval before upgrading `mp-skills`. 7. Execute generator and validator scripts in a constrained environment with minimum filesystem access, restricted network access, and no unnecessary credentials. 8. Replace the setup instruction with a version-pinned, integrity-verified installation procedure and document the exact approved package version. ]]>