T08 · Insecure Dependencies
Error
- Location
- SKILL.md:81
- Finding
- Unpinned Third-Party Packages Are Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 81-103 **Vulnerability Type**: Unpinned dependency installation and execution **Risk Level**: High ### Vulnerable Code ```bash # SKILL.md:81 npx depcheck --json 2>/dev/null | jq '{unused: .dependencies, devUnused: .devDependencies, missing: .missing}' # SKILL.md:87-88 pip install pipreqs 2>/dev/null pipreqs . --print 2>/dev/null > /tmp/actual-imports.txt # SKILL.md:103 npx license-checker --json 2>/dev/null | jq 'to_entries[] | {pkg: .key, license: .value.licenses}' | head -40 ``` ### Technical Analysis The Skill instructs the agent to download, install, and execute third-party packages without pinning reviewed versions, validating integrity hashes, using a project lockfile, or obtaining explicit approval. By default, `npx depcheck` and `npx license-checker` may retrieve the current package version and immediately execute its command. Similarly, `pip install pipreqs` resolves mutable package versions and may execute package build or installation hooks before the subsequently installed `pipreqs` command is run. Consequently, the effective code executed by this Skill can change after the Skill itself has been reviewed. Exploitation would require compromise of a referenced package, one of its transitive dependencies, or the relevant package-distribution channel. There is no evidence in the audited file that these packages are currently malicious; the vulnerability is the unsafe, unpinned execution model. ### Attack Path 1. An attacker compromises a referenced npm or Python package, a transitive dependency, a maintainer account, or the associated distribution channel. 2. The attacker publishes a malicious version that is eligible for default package-manager resolution. 3. An agent follows the dependency-audit workflow in `SKILL.md`. 4. `npx` downloads and immediately executes the malicious npm package, or `pip install` installs a malicious Python distribution and executes applicable bu ...[truncated 1068 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every audit tool to a reviewed version rather than resolving the mutable latest release. 2. For npm tools, install approved versions through a committed lockfile and invoke the local binaries. Where applicable, use `npx --no-install` to prevent implicit downloads. 3. For Python tools, use an isolated virtual environment and pin exact versions and hashes, such as through a hash-locked requirements file with `pip install --require-hashes`. 4. Review and lock transitive dependencies, not only the top-level packages. 5. Prefer preinstalled, organization-approved audit tools in a restricted environment. 6. Require explicit user approval before performing any network download or package installation. 7. Run dependency-audit tools in a sandbox or container with read-only project access, minimal environment variables, no unnecessary credentials, restricted outbound networking, and no elevated privileges. 8. Avoid suppressing all standard error output during installation. Preserve package-manager errors and provenance information so unexpected downloads or installation behavior remain visible. 9. Verify package origin and integrity using registry metadata, lockfile integrity fields, trusted hashes, or signed provenance where supported. ]]>