T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:27
- Finding
- Unpinned Global Package Installation with Trusted Lifecycle Scripts## Vulnerability Details **File Location**: `SKILL.md:27-30` **Vulnerability Type**: Unpinned third-party dependency and trusted package lifecycle scripts **Risk Level**: Medium ### Vulnerable Code ```bash npm install -g agent-desktop # or bun install -g --trust agent-desktop ``` ### Technical Analysis The installation instructions retrieve `agent-desktop` without specifying an exact version or integrity hash. Consequently, the installed implementation can change independently of the reviewed Skill version. Both alternatives install the package globally, increasing the scope of any compromised package code. The Bun alternative explicitly uses `--trust`, allowing package lifecycle scripts to run during installation. The artifact contains only documentation and metadata; it does not include the executable `agent-desktop` implementation or dependency lock data. Therefore, the downloaded package and its transitive dependencies cannot be verified against the reviewed documentation. This is a supply-chain weakness rather than evidence that the current package is malicious. ### Attack Path 1. An attacker compromises the `agent-desktop` package, its publisher account, or a transitive dependency. 2. The attacker publishes a malicious release under the same package name. 3. A user follows the documented unpinned global installation command. 4. The package manager retrieves the attacker-controlled release. 5. With the Bun command, trusted lifecycle scripts can execute during installation. Malicious runtime code can also execute when the CLI is later invoked. 6. If the hosting terminal has macOS Accessibility permission, the compromised CLI can abuse that authority to observe and control desktop applications. ### Impact Assessment Malicious installation scripts or runtime code would execute with the privileges of the installing user. Because the documented tool is intended to run from an Accessibility-enabled terminal, c ...[truncated 570 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to an exact reviewed version, for example: ```bash npm install -g agent-desktop@0.1.8 ``` 2. Publish and verify package integrity information, such as an expected registry integrity hash or signed release artifact. 3. Remove `--trust` unless audited lifecycle scripts are strictly necessary. Document which scripts require trust and what each script performs. 4. Prefer a project-local installation with a committed lockfile over global installation, reducing ambiguity and limiting package resolution changes. 5. Make the executable source and dependency manifest available for review so implementation behavior can be compared with the documented capabilities. 6. Use package provenance or signature verification and a trusted, explicitly configured registry. 7. Run the CLI under a dedicated, least-privileged account or terminal context. Grant Accessibility permission only when needed and revoke it afterward. 8. Add release controls such as reproducible builds, dependency review, vulnerability scanning, and publisher-account multi-factor authentication.