T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:4
- Finding
- Unpinned Third-Party CLI Is Installed and Entrusted with an Anthropic Admin API Key## Vulnerability Details **File Location**: `SKILL.md`, lines 4 and 16-28 **Vulnerability Type**: Unpinned third-party dependency and supply-chain exposure **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"clawdbot":{"emoji":"📊","os":["macos"],"requires":{"bins":["claude-cost","node"]},"install":[{"id":"npm","kind":"shell","command":"npm install -g claude-cost-cli","bins":["claude-cost"],"label":"Install claude-cost-cli via npm"}],"source":"https://github.com/cyberash-dev/claude-cost-cli"}} ``` ```bash npm install -g claude-cost-cli ``` ```bash npm pack claude-cost-cli --dry-run ``` ```bash git clone https://github.com/cyberash-dev/claude-cost-cli.git cd claude-cost-cli npm install && npm run build && npm link ``` ### Technical Analysis The Skill directs users to download and globally install the latest package published under the mutable npm name `claude-cost-cli`. Neither an exact package version nor an integrity hash is specified. The alternative source installation also clones the repository's mutable default branch and installs dependencies without identifying a reviewed commit or providing a lockfile in this artifact. npm package installation can execute package lifecycle scripts. A global installation also exposes the resulting executable through the user's command search path. After installation, the user is instructed to enter an Anthropic Admin API key into this third-party executable. Consequently, the security of the credential and returned organization data depends on the package version, its transitive dependencies, installation scripts, and maintainer infrastructure available at installation time. The suggested `npm pack claude-cost-cli --dry-run` command lists package contents but does not establish that those contents are trustworthy, verify them against a reviewed commit, or prevent lifecycle-script execution during the subsequent installation. The repository con ...[truncated 2060 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the CLI to an explicitly reviewed version rather than installing the latest release, for example `claude-cost-cli@<exact-version>`. 2. Verify the package using a trusted integrity digest, signed release, and npm provenance attestation tied to the exact reviewed source commit. 3. Pin source installations to a full commit hash or signed tag instead of cloning and building the mutable default branch. 4. Audit the exact packed npm artifact, installation scripts, and transitive dependency tree before installation. Do not treat `npm pack --dry-run` as a security verification mechanism. 5. Avoid global installation where possible. Use an isolated environment with a restricted executable path and minimal filesystem and network permissions. 6. Disable npm lifecycle scripts during installation where compatible, then explicitly run only reviewed build steps. 7. Include the relevant implementation and dependency lockfile in the audited Skill artifact so Keychain handling, outbound destinations, TLS use, logging, and credential redaction can be verified locally. 8. Restrict outbound network access for the CLI to the required Anthropic API endpoints and test that credentials cannot be written to logs, command history, temporary files, or standard output. 9. Use an Admin API key with the minimum available permissions and rotate it immediately if package or workstation compromise is suspected.