T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:4
- Finding
- Unverified Third-Party npm Package Is Installed and Executed## Vulnerability Details **File Location**: `SKILL.md:4,55-59` and mirrored configuration in `SKILL-cn.md:4,55-59` **Vulnerability Type**: Third-party dependency and supply-chain exposure **Risk Level**: Medium ### Vulnerable Code ```json "requires":{"bins":["npm","npx"]}, "install":"npm install -g @dlazy/cli@1.2.3", "installAlternative":"npx @dlazy/cli@1.2.3" ``` ```bash npx @dlazy/cli@1.2.3 <command> ``` ```bash npm install -g @dlazy/cli@1.2.3 ``` ### Technical Analysis The Skill delegates its functionality to the externally distributed npm package `@dlazy/cli@1.2.3`. The implementation of that package is not included in the audited project, so its lifecycle scripts and runtime behavior cannot be verified from this artifact. Pinning the dependency to version `1.2.3` limits unexpected version changes, but it does not authenticate the retrieved package independently or protect against compromise of that exact published artifact, its transitive dependencies, the npm account, or the package distribution channel. No package integrity hash, signature verification, vendored source, or installation sandbox is specified. The global installation alternative increases exposure because package lifecycle scripts execute during installation and the resulting executable persists in the user's global npm environment. The `npx` alternative avoids persistent global installation but still downloads and executes externally supplied package code. The same dependency instructions are duplicated in `SKILL-cn.md`, so both documented installation paths carry the same risk. ### Attack Path 1. An attacker compromises the npm package publisher, the package artifact for `@dlazy/cli@1.2.3`, or one of its unresolved transitive dependencies. 2. A user or agent follows the Skill metadata and runs either `npm install -g @dlazy/cli@1.2.3` or `npx @dlazy/cli@1.2.3`. 3. npm retrieves the compromised package and may execute its insta ...[truncated 1457 chars]
- Remediation
- ## Remediation Suggestions 1. Vendor the required CLI implementation or include auditable source code in the Skill package. 2. Verify the npm artifact against a published cryptographic integrity hash or trusted signature before execution. 3. Commit and enforce a lockfile that pins all transitive dependencies, not only the top-level package version. 4. Review the package source, lifecycle scripts, and dependency tree for the exact published version. 5. Prefer ephemeral, isolated execution over global installation. Run the CLI in a container or sandbox with restricted filesystem and network access. 6. Disable npm lifecycle scripts with `--ignore-scripts` where the package can operate without them. 7. Restrict the CLI to only the documented API endpoints and only the files explicitly selected by the user. 8. Store API credentials using an operating-system credential manager where possible, and rotate the API key if dependency compromise is suspected. 9. Document package verification and uninstall procedures, particularly for the global installation path. 10. Apply the same hardened installation guidance to both `SKILL.md` and `SKILL-cn.md`.