T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:12
- Finding
- Unpinned Third-Party Package Is Downloaded and Executed Through npx## Vulnerability Details **File Location**: `SKILL.md`, lines 12-57 **Vulnerability Type**: Unpinned executable dependency / supply-chain risk **Risk Level**: Medium The skill repeatedly instructs agents to execute `@builtbyecho/repo-agent-brief` through `npx` without specifying an immutable package version or verifying package integrity. ```bash npx @builtbyecho/repo-agent-brief . > AGENT_BRIEF.md sed -n '1,220p' AGENT_BRIEF.md npx @builtbyecho/repo-agent-brief . --diff origin/main > AGENT_HANDOFF.md sed -n '1,260p' AGENT_HANDOFF.md npx @builtbyecho/repo-agent-brief . --format json > agent-brief.json npx @builtbyecho/repo-agent-brief . --diff HEAD --bundle sed -n '1,220p' .agent-brief/brief.md sed -n '1,160p' .agent-brief/verification.md npx @builtbyecho/repo-agent-brief . npx @builtbyecho/repo-agent-brief . --diff HEAD npx @builtbyecho/repo-agent-brief . --diff HEAD --bundle npx @builtbyecho/repo-agent-brief . --diff origin/main --fail-on-high-risk npx @builtbyecho/repo-agent-brief . --no-snippets ``` ### Technical Analysis When no version is supplied, `npx` can resolve and download the currently published package version from the configured npm registry and immediately execute its binary. Consequently, the code reviewed when this skill was authored is not necessarily the code executed later. A malicious release, compromised publisher account, registry compromise, or unsafe registry configuration could cause attacker-controlled package code to run. Package execution is not sandboxed by these instructions. The process normally inherits the invoking user's environment, filesystem permissions, working directory, network access, and accessible credentials. The repository-oriented nature of the command increases exposure because it is deliberately executed from the repository root and receives the repository path as input. There is no evidence that the named package is currently malicious; the vulnerability is ...[truncated 1734 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to a reviewed, exact version in every command, for example: ```bash npx --yes @builtbyecho/repo-agent-brief@X.Y.Z . ``` Do not use `latest`, caret ranges, tilde ranges, tags, or other mutable selectors. 2. Prefer declaring the package in a controlled project manifest and committing the associated lockfile. Install dependencies with a lockfile-enforcing command such as: ```bash npm ci --ignore-scripts ``` Confirm that disabling lifecycle scripts is compatible with the package before adoption. 3. Review the pinned package version, its transitive dependency graph, exposed binary, lifecycle scripts, provenance, and published integrity metadata before approving it. 4. Configure npm to use an approved registry, enforce lockfile integrity, and apply organizational package allowlisting where available. 5. Execute the tool in a sandbox or minimally privileged environment with restricted credentials, read-only repository access where practical, and controlled outbound network access. 6. In CI, do not expose deployment credentials or unrelated secrets to the analysis step. Grant the job only the repository and token permissions required for generating the brief. 7. Add an automated dependency-update process in which each proposed version change is reviewed and tested before the pinned version is changed.