T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:13
- Finding
- Mutable External Dependencies and Skill Content Are Retrieved Without Version Pinning## Vulnerability Details **File Locations**: - `SKILL.md:13-16` - `SKILL.md:46-48` - `SKILL.md:196-199` - `recipes/deploy-from-ci.md:19-27` - `recipes/deploy-from-ci.md:52-60` - `references/cookbooks.md:15-19` **Vulnerability Type**: Unpinned executable dependencies and remotely retrieved Skill content **Risk Level**: Medium ### Vulnerable Code `SKILL.md:13-16`: ```yaml install: - kind: node package: "@cargo-ai/cli@latest" bins: - cargo-ai ``` `SKILL.md:46-48`: ```bash npm install -g @cargo-ai/cli # no global install? prefix every command with `npx @cargo-ai/cli` cargo-ai login --email you@company.com # emailed code, no browser; creates the account on first use # alternatives: --oauth (browser) · --token <api-token> (CI) ``` `SKILL.md:196-199`: ```text npx skills add getcargohq/gtm-skills/<slug> ``` ```text npx skills use getcargohq/gtm-skills@<slug> ``` `recipes/deploy-from-ci.md:19-27`: ```bash # 1. Install the CLI (project already depends on @cargo-ai/cdk via package.json) npm install -g @cargo-ai/cli@latest npm ci # 2. Authenticate non-interactively with the token (selects the token's workspace) cargo-ai login --token "$CARGO_API_TOKEN" # 3. Deploy — --yes is REQUIRED (no TTY to confirm at); --json for machine-readable output cargo-ai project deploy --yes --json ``` `recipes/deploy-from-ci.md:52-60`: ```yaml # .github/workflows/deploy.yml - run: npm install -g @cargo-ai/cli@latest && npm ci - run: cargo-ai login --token "$CARGO_API_TOKEN" env: CARGO_API_TOKEN: ${{ secrets.CARGO_API_TOKEN }} - run: cargo-ai project deploy --yes --json env: HUBSPOT_API_KEY: ${{ secrets.HUBSPOT_API_KEY }} ``` `references/cookbooks.md:15-19`: ```sh cargo-ai project add cookbook/<slug> # inside a CDK project: this is the copy step c ...[truncated 3423 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `@cargo-ai/cli@latest` with an explicitly reviewed version, for example: ```yaml package: "@cargo-ai/cli@1.0.96" ``` Apply the same exact version in local and CI installation instructions. 2. Avoid unversioned `npx` execution. Pin the package that provides the `skills` command to an exact version and invoke it without allowing automatic substitution by a newer release. 3. Pin externally retrieved Skill content to an immutable Git commit or signed release tag. Record the expected revision in project configuration so future changes require explicit review. 4. Verify package integrity using a committed lockfile and registry integrity metadata. Prefer project-local dependencies installed with `npm ci` over global mutable installations. 5. Install and validate dependencies in an isolated step before exposing deployment credentials. Only make `CARGO_API_TOKEN`, connector keys, and other secrets available to the minimum command that requires each credential. 6. Use short-lived, workspace-scoped CI tokens with narrowly limited permissions. Separate planning and deployment jobs, and prevent pull-request workflows from receiving production secrets. 7. Review downloaded Skill procedures before copying them into `.claude/skills/` or `.agents/skills/`. Do not automatically load newly downloaded instructions in a privileged Agent session. 8. Use trusted registry configuration, package provenance/signature verification where available, protected release tags, and dependency monitoring to detect unexpected publisher or artifact changes.