T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:12
- Finding
- Mutable Third-Party CLI Dependency Is Installed and Executed Without Version Pinning## Vulnerability Details **File Location**: `SKILL.md`, lines 5 and 12–16; executable installation guidance at lines 53–55 **Vulnerability Type**: Supply-chain risk caused by a mutable dependency reference **Risk Level**: Medium ### Vulnerable Code ```yaml compatibility: Requires @cargo-ai/cli (npm). Sign in or create an account with `cargo-ai login --email` (emailed code, no browser), `--oauth`, or an API token ``` ```yaml install: - kind: node package: "@cargo-ai/cli@latest" bins: - cargo-ai ``` ```bash npm install -g @cargo-ai/cli # no global install? prefix every command with `npx @cargo-ai/cli` cargo-ai login --email you@company.com # emailed code, no browser; creates the account on first use # alternatives: --oauth (browser) · --token <api-token> (CI) ``` ### Technical Analysis The Skill directs the runtime or user to obtain `@cargo-ai/cli@latest` and also recommends unversioned `npm install` and `npx` invocations. These references resolve mutable package-registry content at installation or execution time. Consequently, the code that runs is not necessarily the version reviewed when this Skill was published. This is inconsistent with the statement at `SKILL.md:43` that functionality is available in a “pinned CLI (1.0.66).” The package declaration and Bootstrap commands do not enforce that pin. No evidence indicates that the current package is malicious. The vulnerability is the unsafe trust model: future package releases, a compromised publisher account, or registry compromise could alter the effective executable payload without any change to the reviewed Skill. ### Attack Path 1. An attacker compromises the npm publisher account, release pipeline, or another component capable of publishing `@cargo-ai/cli`. 2. The attacker publishes a malicious release under the legitimate package name and makes it the registry's latest version. 3. A user installs the Skill or follows its Bootst ...[truncated 1443 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to an exact reviewed release in metadata: ```yaml install: - kind: node package: "@cargo-ai/cli@1.0.66" bins: - cargo-ai ``` 2. Pin every installation and fallback command consistently: ```bash npm install -g @cargo-ai/cli@1.0.66 npx --yes @cargo-ai/cli@1.0.66 ``` 3. Remove `@latest` and unversioned package references from all executable guidance. Ensure the declared dependency matches the version claimed at `SKILL.md:43`. 4. Prefer a project-local, lockfile-controlled installation over a global installation where operationally feasible. Commit the lockfile and use `npm ci` to obtain the reviewed dependency graph deterministically. 5. Verify package provenance and integrity during release and installation. Restrict package publication with multi-factor authentication, protected CI releases, and npm provenance attestations. 6. Establish a reviewed upgrade process: assess each new CLI release, update the exact pin and integrity information, regenerate metadata, and publish a new Skill version only after validation.