T08 · Insecure Dependencies
Warning
- Location
SKILL.md:10- Finding
Unaudited Third-Party npm Package Is Installed and Executed
- Content
View full analysis
Vulnerability Details
File Locations:
SKILL.md:10-11, 62-68;SKILL-cn.md:10-11, 62-68
Vulnerability Type: T08: Insecure Dependencies
Risk Level: MediumVulnerable Code
SKILL.md:10-11andSKILL-cn.md:10-11:yaml 'install': 'npm install -g @dlazy/cli@1.0.9', 'installAlternative': 'npx @dlazy/cli@1.0.9',SKILL.md:62-68:markdown - **npm package**: `@dlazy/cli` (pinned to `1.0.8` in this skill's install spec) You can install on demand without persisting a global binary by running: ```bash npx @dlazy/cli@1.0.9 <command>text The equivalent installation and execution instructions appear in `SKILL-cn.md:62-68`. ### Technical Analysis The Skill directs the host to retrieve and execute `@dlazy/cli@1.0.9` from the npm registry. The package implementation, integrity metadata, dependency lockfile, and transitive dependency tree are not included in the audited project, which contains only the two Skill documentation files. Consequently, the behavior of the executable and any npm lifecycle scripts cannot be verified from this artifact. Pinning the package to version `1.0.9` reduces unintended version drift but does not protect against a compromised publisher account, compromised registry artifact, malicious lifecycle scripts, or vulnerable transitive dependencies. The global installation command additionally writes a persistent executable into the user's npm global installation area. The provenance text also incorrectly says that the installation specification is pinned to `1.0.8`, while every executable installation command uses `1.0.9`. This inconsistency can cause reviewers to inspect a different release from the one actually executed. The Skill documentation claims that runtime activity is limited to Pixabay access, but its metadata lists `api.dlazy.com` and `files.dlazy.com`. Because the runtime implementation is external to the audited artifact, its actual network ...[truncated 1926 chars]- Remediation
View remediation
Remediation Suggestions
- Vendor or bundle the required implementation with the Skill so its behavior can be reviewed alongside the Skill definition.
- Publish and verify a cryptographic integrity digest for the exact npm artifact before installation or execution.
- Include a lockfile and review the complete transitive dependency tree using dependency and malware scanning tools.
- Prefer a project-local, sandboxed installation over
npm install -gto limit persistence and filesystem exposure. - Disable npm lifecycle scripts where compatible, for example by using
--ignore-scripts, and explicitly audit any scripts that are required. - Run the CLI with least privilege in an isolated environment with restricted filesystem and network access.
- Expose the API key only for the specific invocation that requires it, and prevent the package from accessing unrelated secrets.
- Restrict outbound traffic to documented and necessary endpoints, and reconcile the claimed Pixabay-only behavior with the declared dLazy endpoints.
- Correct the provenance documentation so that the reviewed version and executed version consistently identify
1.0.9. - Avoid executing the package automatically during Skill loading; require explicit user approval before downloading or running third-party code.