T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:33
- Finding
- Unpinned Third-Party Package Is Downloaded and Executed Automatically## Vulnerability Details **File Location**: `SKILL.md`, lines 33-39 **Vulnerability Type**: Unpinned npm dependency and mutable remote execution **Risk Level**: Medium **Complete Code Snippet**: ```bash npx -y socialdatax-skills@latest xhs search \ --keyword "<keyword>" --pretty --source-client socialdatax-skills \ --source-platform clawhub --source-skill xhs-content-research npx -y socialdatax-skills@latest xhs search \ --keyword "<keyword>" --pages 3 --pretty --source-client socialdatax-skills \ --source-platform clawhub --source-skill xhs-content-research ``` ### Technical Analysis The documented commands use `npx -y` to download and execute `socialdatax-skills@latest`. The `latest` npm distribution tag is mutable, meaning the code executed during a future invocation may differ from the code available when this Skill was reviewed. The `-y` option suppresses the package installation confirmation. The project contains no pinned package version, lockfile, recorded integrity hash, or vendored implementation with which to verify the downloaded executable. Consequently, the effective behavior cannot be established solely from the audited artifact. If the npm publisher account, package, release process, or upstream dependencies are compromised, a malicious release could run automatically when an agent follows these instructions. ### Attack Path 1. An attacker compromises the `socialdatax-skills` npm publisher account, release pipeline, package contents, or a relevant upstream dependency. 2. The attacker publishes a malicious package version and causes the mutable `latest` tag to reference it. 3. An agent follows the commands in `SKILL.md`. 4. `npx -y` retrieves the current remotely published package without requesting confirmation. 5. Node.js executes the downloaded package with the privileges and environment of the invoking agent or user. 6. The malicious package can access process-visible reso ...[truncated 882 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `socialdatax-skills@latest` with a reviewed, exact package version; do not use a mutable npm distribution tag or semantic version range. 2. Declare the package in a committed manifest and lockfile, then install it using a reproducible command such as `npm ci`. 3. Verify registry provenance and package integrity before execution. Preserve and validate the expected lockfile integrity metadata in CI and deployment workflows. 4. Remove automatic `-y` installation where interactive approval is appropriate, and separate dependency installation from normal Skill execution. 5. Review dependency updates before changing the pinned version, including package provenance, release diffs, maintainers, lifecycle scripts, and transitive dependency changes. 6. Run the CLI in a restricted environment with least privilege, limited filesystem access, controlled outbound networking, and only the required `SOCIALDATAX_API_KEY` exposed. 7. Avoid exposing unrelated secrets through inherited environment variables. Supply the API key only to the specific subprocess that requires it. 8. Where practical, mirror the approved package in a controlled registry or vendor and review the executable implementation.