T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:48
- Finding
- Execution of an Unreviewed Third-Party npm Package## Vulnerability Details **File Location**: `SKILL.md:48` **Vulnerability Type**: Third-party supply-chain dependency execution **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash npx @dlazy/cli@1.2.3 <command> ``` ### Technical Analysis The Skill instructs the agent to execute `@dlazy/cli@1.2.3` directly from the npm ecosystem. The implementation of that package is not included in the audited artifact, which contains only two Markdown files. Consequently, its installation scripts, transitive dependencies, runtime behavior, network activity, and handling of credentials or local files cannot be verified from this project. Running a package through `npx` may download and execute package code with the permissions of the invoking user. Although the dependency is pinned to a version, version pinning alone does not establish package integrity or protect against a compromised publisher account, malicious release, registry compromise, or unsafe transitive dependency. The Skill also supports global installation using `npm install -g @dlazy/cli@1.2.3`, which can increase the duration and system-wide scope of the installed component. The documentation contains a provenance inconsistency: one statement identifies the fixed install version as `1.0.9`, while the executable installation and `npx` instructions use `1.2.3`. This inconsistency can impede dependency review and verification. ### Attack Path 1. A user activates the brochure-generation Skill. 2. The Skill directs the agent to install or execute `@dlazy/cli@1.2.3`. 3. `npx` retrieves the package and its dependencies from the configured npm registry if they are not already cached. 4. npm package lifecycle scripts or runtime code execute with the invoking user's permissions. 5. If the package, publisher account, registry response, or transitive dependency is compromised, attacker-controlled code can run locally. 6. The malicious code could access data available t ...[truncated 945 chars]
- Remediation
- ## Remediation Suggestions 1. Vendor the required CLI implementation into a reviewable package or include a reproducible reference to the exact audited source revision. 2. Verify the npm artifact against an approved cryptographic integrity digest rather than relying only on a version number. 3. Commit and enforce a lockfile for all transitive dependencies where applicable. 4. Correct the `1.0.9` versus `1.2.3` documentation inconsistency and use one reviewed version throughout. 5. Review package lifecycle scripts and disable them with `--ignore-scripts` where the CLI does not require them. 6. Prefer an isolated, least-privilege environment instead of global installation. 7. Require explicit user approval before downloading or installing the package. 8. Restrict filesystem and network access to the minimum required endpoints and directories. 9. Ensure API credentials are scoped, rotated regularly, and never exposed through command-line arguments or logs. 10. Audit the package publisher, release provenance, transitive dependency tree, and npm registry configuration before deployment.