T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:7
- Finding
- Unverified Third-Party CLI Installation and Execution## Vulnerability Details **File Location**: `SKILL.md:7, 42, 48, 51`; identical declarations also appear in `SKILL-cn.md:7, 42, 48, 51` **Vulnerability Type**: Supply-chain risk caused by unverified npm package installation and execution **Risk Level**: Medium ### Vulnerable Code ```json "requires": { "bins": ["npm", "npx"] }, "install": "npm install -g @dlazy/cli@1.2.3", "installAlternative": "npx @dlazy/cli@1.2.3" ``` ```bash npx @dlazy/cli@1.2.3 <command> ``` The provenance section additionally claims that the installation field is pinned to version `1.0.9`, while the executable metadata and commands specify version `1.2.3`. ### Technical Analysis The Skill directs the Agent to retrieve and execute `@dlazy/cli@1.2.3` from the npm ecosystem. Although the package version is pinned, the project does not provide a package-lock file, an expected integrity digest, a vendored and reviewed copy of the CLI, or another mechanism that cryptographically binds execution to the implementation reviewed during this audit. Both installation methods execute code outside the audited project: - `npm install -g` can run npm lifecycle scripts and installs executable code globally for the current environment. - `npx` retrieves and executes registry-delivered code on demand. The external package consequently runs with the permissions of the Agent's operating-system account. Those permissions may include access to local files, environment variables, the stored dLazy API key, and network resources. The mismatch between the documented version `1.0.9` and the executed version `1.2.3` also creates review ambiguity: an operator may inspect one release while the Skill executes another. This audit found no evidence that the specified package is currently malicious. The vulnerability is the absence of sufficient dependency verification and containment around externally supplied executable code. ### Attack Path 1. A user invo ...[truncated 1602 chars]
- Remediation
- ## Remediation Suggestions 1. Correct the version inconsistency so every metadata field, command example, and provenance statement identifies the same reviewed release. 2. Publish and verify an expected npm integrity digest for the package artifact. Use a lockfile with integrity fields for all transitive dependencies where the host supports it. 3. Include the reviewed CLI source or a vendored, reproducibly built artifact within the audit scope. 4. Prefer isolated, non-global execution over `npm install -g`. Run the CLI in a restricted container, sandbox, or dedicated low-privilege account. 5. Disable npm lifecycle scripts where operationally possible, or explicitly audit every required lifecycle script before allowing execution. 6. Require explicit user approval before package installation and display the exact package name, version, registry, and expected integrity value. 7. Restrict filesystem and network access to the minimum necessary directories and declared dLazy endpoints. 8. Keep API credentials out of command-line arguments and ensure the configuration file has restrictive user-only permissions. 9. Continuously monitor the package and its transitive dependencies for ownership changes, advisories, unexpected publication activity, and integrity changes.