T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:19
- Finding
- Unpinned Third-Party Package Is Downloaded and Executed Automatically## Vulnerability Details **File Location**: `SKILL.md`, line 19 **Vulnerability Type**: Supply-chain risk caused by unpinned remote package execution **Risk Level**: Medium **Vulnerable Code**: ```bash npx -y @just-every/crawl \"https://help.aliyun.com/zh/model-studio/models\" > alicloud-model-studio-models.md ``` ### Technical Analysis The documented workflow invokes `npx` with the package name `@just-every/crawl` but does not specify an exact, reviewed version. It also provides no lockfile, package checksum, or other integrity-verification mechanism. Consequently, the code executed by this command can change after the Skill has been audited. The `-y` option automatically accepts installation prompts, allowing the resolved package to be downloaded and executed without an explicit user confirmation step. This creates a supply-chain trust boundary: control of the package registry entry or its publication credentials can translate directly into local code execution when a user follows the workflow. ### Attack Path 1. An attacker compromises the package publisher account, package registry entry, or another relevant dependency-distribution mechanism. 2. The attacker publishes a malicious version that can be selected by the unversioned package reference. 3. A user follows the workflow in `SKILL.md`. 4. `npx -y` resolves and downloads the attacker-controlled package version without interactive confirmation. 5. The malicious package executes with the operating-system identity and permissions of the user running the command. ### Impact Assessment A malicious resolved package could execute arbitrary code with the invoking user's privileges. The potential scope includes reading or modifying files accessible to that user, accessing environment variables and locally available credentials, making network requests, altering generated project artifacts, and compromising the working repository. This workflow does not itself request el ...[truncated 154 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to an exact, reviewed version, for example: ```bash npx --yes @just-every/crawl@<reviewed-exact-version> "https://help.aliyun.com/zh/model-studio/models" > alicloud-model-studio-models.md ``` 2. Record dependency resolution in a committed lockfile and install dependencies with a lockfile-enforcing command such as `npm ci`. 3. Verify package integrity through the package manager's integrity metadata or a separately maintained trusted checksum. 4. Review the pinned package and its transitive dependencies before updating the version. 5. Remove automatic confirmation suppression where practical so unexpected installation behavior remains visible. 6. Run the crawler in a restricted environment with minimal filesystem access, no unnecessary credentials, and constrained network permissions. 7. Establish a controlled dependency-update process that includes security review and automated vulnerability scanning.