T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:31
- Finding
- Third-Party Package Installation Without Artifact Integrity Verification## Vulnerability Details **File Location**: `SKILL.md`, lines 31–46 **Vulnerability Type**: Supply-chain exposure through third-party package installation **Risk Level**: Medium ### Vulnerable Code ```markdown ## Installation ### NPM ```bash npm install -g @maton/cli@0.3.1 ``` ### Homebrew ```bash brew install maton-ai/cli/maton brew pin maton ``` Versions are pinned to the release this skill was reviewed against. Upgrade deliberately - check the release notes, then move the pin - rather than by re-running an unpinned install. Homebrew cannot select a version from a tap, so `brew pin maton` holds the installed build until you choose to upgrade; `maton-ai/cli` is Maton's own tap. ``` Optional SDK installation instructions at `SKILL.md`, lines 1246–1268, similarly install third-party packages: ```bash pip install 'maton-ai==0.3.1' npm install @maton/sdk@0.3.1 ``` ### Technical Analysis The Skill directs users to install a globally scoped npm CLI, a package from a publisher-controlled Homebrew tap, and optional npm or Python SDK packages. Although versions are pinned, the documentation does not require cryptographic checksum, signature, provenance, or immutable artifact verification. Version pinning reduces exposure to unexpected upgrades but does not establish that the selected artifact is authentic. A compromised publisher account, package registry, tap repository, release pipeline, or artifact could replace a pinned package version where the distribution platform permits replacement or could compromise the source from which Homebrew resolves the formula. Package installation can execute package lifecycle hooks, formula installation logic, or other publisher-controlled code with the privileges of the user running the installation. The global npm installation increases the affected local scope and can place executable files in shared command locations. No evidence was found that the currently ref ...[truncated 1860 chars]
- Remediation
- ## Remediation Suggestions 1. Publish SHA-256 or stronger checksums for every reviewed CLI and SDK artifact, and require verification before installation. 2. Provide signed releases and document verification against a pinned, independently distributed signing key. 3. Use registry provenance or software supply-chain attestations, such as Sigstore verification and SLSA-compatible build provenance. 4. Pin the Homebrew formula to an immutable reviewed commit and verify the downloaded binary or source archive inside the formula. 5. Prefer isolated installation in a dedicated virtual environment, container, or restricted user account instead of global npm installation. 6. Where compatible, disable npm lifecycle scripts during installation and explicitly document any scripts required for legitimate operation. 7. Publish dependency lockfiles and software bills of materials for the CLI and SDK packages. 8. Document package hashes associated with the exact Skill version so reviewers can reproduce and validate the audited dependency set. 9. Advise users to install with the minimum required operating-system privileges and never with unnecessary administrator or root access. 10. Add a documented incident-response procedure requiring credential revocation and rotation if package integrity verification fails.