T08 · Insecure Dependencies
- Location
SKILL.md:18- Finding
Unpinned Vercel CLI Execution Through npx
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 18–32
Vulnerability Type: Unpinned third-party package execution
Risk Level: MediumVulnerable Code
bash # Buy a domain (interactive — needs pty:true) npx vercel domains buy mydomain.com # List your owned domains npx vercel domains list # Inspect a domain you own npx vercel domains inspect mydomain.com # Add domain to a Vercel project npx vercel domains add mydomain.com my-project # Transfer a domain into Vercel npx vercel domains transfer-in mydomain.comThe same unpinned execution pattern is also documented at lines 43–51, 77–83, and 105.
Technical Analysis
The Skill instructs the agent to execute the
vercelnpm package throughnpxwithout specifying an exact reviewed version or verifying package integrity. If the package is not already available locally,npxcan retrieve executable package content from the configured npm registry at runtime. Consequently, the code ultimately executed can differ from the code that was available when the Skill was reviewed.This creates a software supply-chain exposure. A compromised upstream release, registry account, registry configuration, or package resolution path could cause attacker-controlled package code to execute under the invoking user's account. The concern is amplified because the documented workflow uses Vercel authentication stored locally and includes financially and operationally sensitive commands such as purchasing, moving, removing, and assigning domains.
The audit found no evidence that the Skill itself compromises the package or deliberately redirects resolution to a malicious source. The vulnerability is the unsafe dependency execution pattern and the lack of version and integrity controls.
Attack Path
- An agent or user follows the Skill and runs an unpinned command such as
npx vercel domains buy mydomain.com. npxresolves thevercelpackag ...[truncated 1581 chars]
- An agent or user follows the Skill and runs an unpinned command such as
- Remediation
View remediation
Remediation Suggestions
-
Pin the Vercel CLI to an exact, reviewed version, for example:
bash npx --yes vercel@X.Y.Z domains listReplace
X.Y.Zwith an explicitly approved release rather than a floating tag or version range. -
Prefer installing dependencies through a committed lockfile and a controlled installation process, such as
npm ci, so package versions and integrity hashes are reproducible. -
Configure npm to use the official or an organization-approved registry, and prevent project-level or user-level registry configuration from silently redirecting package resolution to an untrusted source.
-
Verify package provenance, signatures, integrity metadata, and publisher identity before approving version upgrades.
-
Execute the CLI with minimum filesystem and account privileges. Use a narrowly scoped Vercel token where supported, and avoid exposing unrelated credentials to the process.
-
Require explicit user confirmation immediately before purchases, transfers, removals, moves, or other financially or operationally sensitive domain actions. Do not rely solely on the CLI's interactive behavior as an authorization control.
-
Apply the pinned-version requirement consistently to every
npx vercelexample inSKILL.md, including the occurrences at lines 43–51, 77–83, and 105.
-