T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Third-Party CLI Is Retrieved and Executed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5, 50-56`; duplicated in `SKILL-cn.md:5, 48-54` **Vulnerability Type**: Supply-chain risk from an externally retrieved executable dependency **Risk Level**: Medium ### Vulnerable Code From `SKILL.md:5`: ```json "install":"npm install -g @dlazy/cli@1.2.3", "installAlternative":"npx @dlazy/cli@1.2.3" ``` From `SKILL.md:50-56`: ```bash npx @dlazy/cli@1.2.3 <command> ``` The equivalent installation and invocation instructions appear in `SKILL-cn.md:5, 48-54`. ### Technical Analysis The Skill delegates its operation to the externally distributed `@dlazy/cli` npm package. Although the package version is pinned to `1.2.3`, the project does not include the CLI implementation, a vendored dependency, a package lockfile, a cryptographic checksum, or a signature-verification procedure. Version pinning limits unexpected upgrades but does not independently authenticate the retrieved package contents. Both `npm install -g` and `npx` can retrieve executable package content from the npm distribution channel. Package installation may also execute npm lifecycle scripts unless explicitly disabled. Consequently, the effective code executed by the Skill cannot be verified solely by auditing this project. The global installation option increases exposure by persisting the executable outside the Skill directory and making it available to later sessions. The CLI is also expected to access the user's dLazy API key, selected local media, and remote API endpoints, making compromise of this dependency security-sensitive. No evidence was found that the named package is currently malicious. This finding concerns the absence of dependency integrity controls and the resulting supply-chain attack surface. ### Attack Path 1. An attacker compromises the npm package publisher account, package artifact, registry delivery path, or another relevant distribution component. 2. Malicious content is associated with or served for ...[truncated 1436 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Vendor and audit the required CLI implementation within a controlled repository or package artifact so the executed code is included in the review scope. 2. Publish a cryptographic checksum or signed provenance attestation for the approved package artifact and verify it before execution. 3. Commit a lockfile that records the exact resolved artifact and integrity value where npm-based installation remains necessary. 4. Prefer a local, project-scoped installation over `npm install -g` to prevent the executable from persisting globally. 5. Avoid automatic `npx` downloads in production workflows. Configure npm to use an approved registry and require the package to be present in a verified local cache. 6. Disable npm lifecycle scripts with `--ignore-scripts` if the package can operate without them. If lifecycle scripts are required, audit each script and document the necessity. 7. Run the CLI in a restricted sandbox or container with: - Access only to explicitly selected media files. - No access to unrelated home-directory content. - A narrowly scoped API credential. - Network access limited to documented dLazy endpoints. - No administrative privileges. 8. Protect `~/.dlazy/config.json` with restrictive permissions, rotate exposed credentials, and prefer short-lived or narrowly scoped tokens where supported. 9. Apply the same hardened installation guidance consistently in both `SKILL.md` and `SKILL-cn.md`. ]]>