T08 · Insecure Dependencies
Error
- Location
- SKILL.md:30
- Finding
- Automatic Execution of an Unpinned npm Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 30-37 **Vulnerability Type**: Unpinned and automatically executed third-party dependency **Risk Level**: High ### Vulnerable Code ```bash npx -y socialdatax-skills@latest douyin user-info \ --sec-user-id "<sec_user_id>" --pretty --source-client socialdatax-skills \ --source-platform clawhub --source-skill socialdatax-douyin-creator-profile npx -y socialdatax-skills@latest douyin user-info \ --profile-url "<profile_url_or_share_text>" --pretty \ --source-client socialdatax-skills --source-platform clawhub \ --source-skill socialdatax-douyin-creator-profile ``` The risk is reinforced by the automatic installation instruction at `SKILL.md:72`: ```text If the current environment has permission, install or restore automatically. ``` ### Technical Analysis The Skill instructs the agent to invoke `npx` with both `-y` and the mutable `@latest` version specifier: - `@latest` does not identify an immutable, audited package version. Its target can change after this Skill has been reviewed. - `npx` can download the selected package from the npm registry and execute its code locally. - `-y` suppresses the normal installation confirmation, facilitating unattended retrieval and execution. - The project does not provide a lockfile, integrity hash, exact version constraint, vendored implementation, or other mechanism to ensure that the executed code is the version originally reviewed. - The documentation encourages automatic installation or restoration when permissions permit. The repository does not itself contain evidence that the current npm package is malicious. The confirmed issue is the unsafe dependency execution pattern, which creates a supply-chain execution channel if the package, its publisher account, or its dependency graph is compromised. ### Attack Path 1. An attacker compromises the `socialdatax-skills` npm publisher account, package release process, or a transitive depen ...[truncated 1540 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace `socialdatax-skills@latest` with an exact, reviewed package version, such as `socialdatax-skills@X.Y.Z`. 2. Commit and enforce a lockfile containing verified dependency versions and registry integrity hashes. 3. Remove `-y` so that package acquisition is not silently approved. 4. Separate dependency installation from command execution and require explicit user or administrator approval before downloading new code. 5. Install from the official npm registry using a controlled registry configuration, and reject unexpected alternate registries or package sources. 6. Verify package provenance, signatures, checksums, and publisher identity before installation where supported. 7. Disable or carefully control npm lifecycle scripts during installation unless they are explicitly required and reviewed. 8. Execute the CLI in a sandbox with minimal filesystem and network permissions. 9. Pass only the required API credential to the child process rather than exposing the complete parent environment. 10. Establish a controlled upgrade process in which new package versions and transitive dependency changes are reviewed before updating the pinned version. 11. Revise the troubleshooting guidance so that dependencies are not installed or restored automatically without explicit approval and integrity validation. ]]>