T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- External npm CLI Executed Without Artifact Integrity Verification## Vulnerability Details **File Location**: `SKILL.md`, lines 5 and 51-63; `SKILL-cn.md`, lines 5 and 51-63 **Vulnerability Type**: Third-party supply-chain exposure **Risk Level**: Medium ### Vulnerable Code Snippet Both documents declare and recommend executing the same external npm package: ```json "install": "npm install -g @dlazy/cli@1.2.3", "installAlternative": "npx @dlazy/cli@1.2.3" ``` ```bash npx @dlazy/cli@1.2.3 <command> ``` ```bash npm install -g @dlazy/cli@1.2.3 ``` ### Technical Analysis The Skill delegates its executable behavior, authentication handling, filesystem access, and network communication to `@dlazy/cli@1.2.3`, which is retrieved from an external npm registry. The package implementation is not included in the audited project. Pinning the dependency to version `1.2.3` limits version drift, but the Skill does not specify an npm integrity hash, an approved lockfile, a signed release artifact, or a verified source commit corresponding to the published package. Consequently, the reviewed Skill files alone cannot establish the integrity or behavior of the executable artifact. npm package installation may also execute package lifecycle scripts. The global installation option persists the executable outside the Skill directory and makes it available to later sessions. This does not prove that the referenced package is malicious; it creates a supply-chain trust boundary that is not controlled or verifiable from this project. ### Attack Path 1. An attacker compromises the npm publisher account, package publication workflow, registry artifact, or another component of the package supply chain. 2. The affected artifact is made available under the package and version referenced by the Skill, or the expected artifact is otherwise substituted in an environment lacking integrity enforcement. 3. An Agent follows the Skill instructions and runs `npx @dlazy/cli@1.2.3` or installs the package ...[truncated 1289 chars]
- Remediation
- ## Remediation Suggestions 1. Vendor the reviewed CLI implementation into the Skill package, or distribute it through a controlled and authenticated artifact repository. 2. Record and enforce the expected package integrity hash through a reviewed lockfile or equivalent artifact-verification mechanism. 3. Link version `1.2.3` to a specific reviewed source commit and verify that the published npm artifact is reproducibly built from that commit. 4. Prefer ephemeral, least-privilege execution over global installation. Remove the global installation recommendation unless persistence is operationally necessary. 5. Disable npm lifecycle scripts where compatible with the verified package, for example by using an approved installation process with lifecycle-script restrictions. 6. Execute the CLI in a sandbox with access limited to required media files, configuration data, and the documented domains `api.dlazy.com` and `files.dlazy.com`. 7. Store API credentials using an operating-system credential manager where possible, and ensure that credentials are scoped, rotatable, and not exposed to unrelated subprocesses. 8. Add package provenance or signature verification to the installation workflow and fail closed if verification cannot be completed.