T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:29
- Finding
- Execution of an Unpinned Third-Party npm Package## Vulnerability Details **File Location**: `SKILL.md`, lines 29–36 **Vulnerability Type**: Supply-chain exposure through mutable dependency execution **Risk Level**: Medium **Complete Code Snippet**: ```bash npx -y socialdatax-skills@latest xhs user-info \ --user-id "<user_id>" --pretty --source-client socialdatax-skills \ --source-platform clawhub --source-skill socialdatax-xhs-creator-profile npx -y socialdatax-skills@latest xhs user-info \ --profile-url "<profile_url_or_share_text>" --pretty \ --source-client socialdatax-skills --source-platform clawhub \ --source-skill socialdatax-xhs-creator-profile ``` ### Technical Analysis The documented commands instruct the agent to use `npx -y` to download and execute `socialdatax-skills@latest`. The `latest` npm tag is mutable, so the code executed during a future invocation may differ from the code reviewed when this Skill was published. The `-y` option suppresses the normal installation confirmation, enabling unattended retrieval and execution. No version lock, package-integrity hash, vendored implementation, or other mechanism constrains the downloaded artifact to a reviewed release. The package implementation is not present in the audited project, which contains only `SKILL.md`; consequently, its runtime behavior cannot be verified from the repository. The Skill also declares `SOCIALDATAX_API_KEY` as a required environment variable. A downloaded npm process may inherit that credential and the agent process's filesystem and network permissions. This is a supply-chain risk rather than proof that the current package release is malicious. ### Attack Path 1. An attacker compromises the npm publisher account, package build/release pipeline, or an upstream dependency used by `socialdatax-skills`. 2. The attacker publishes a malicious release and assigns it to the mutable `latest` distribution tag. 3. An agent follows the Skill documentation and in ...[truncated 1172 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `socialdatax-skills@latest` with an exact, reviewed package version; do not use a version range or mutable distribution tag. 2. Verify the package artifact against a trusted integrity hash or lockfile before execution. 3. Review the pinned package and its transitive dependencies before deployment, and repeat that review before upgrading. 4. Prefer a controlled installation step over downloading executable code at every invocation. 5. Run the CLI in a sandbox or restricted service account with minimal filesystem access and outbound network access limited to required endpoints. 6. Expose only `SOCIALDATAX_API_KEY` to the process rather than the agent's complete environment, and avoid making unrelated credentials available. 7. Remove unattended `-y` execution where interactive approval is feasible, or enforce package allowlisting in automated environments. 8. Add dependency monitoring and an explicit upgrade process so new versions are reviewed, tested, and pinned before use.