T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:6
- Finding
- Unpinned Global Installation of an Unverifiable Third-Party npm Package## Vulnerability Details **File Location**: `SKILL.md`, lines 6-15 **Vulnerability Type**: Unpinned third-party dependency installed as a global executable **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"clawdbot":{"emoji":"📧","requires":{"bins":["fruitmail"]},"install":[{"id":"node","kind":"node","package":"apple-mail-search-cli","bins":["fruitmail"],"label":"Install fruitmail CLI (npm)"}]}} ``` ```bash npm install -g apple-mail-search-cli ``` ### Technical Analysis The skill instructs users or agents to install `apple-mail-search-cli` globally without specifying an exact package version, integrity hash, lockfile, or other reproducibility control. Consequently, npm resolves whichever release is current in the configured registry at installation time. The installed package supplies the `fruitmail` executable and is expected to access sensitive Apple Mail resources, including the local Envelope Index and complete message bodies. However, the audited project contains only `SKILL.md` and `_meta.json`; it does not include the dependency's implementation. The claimed read-only behavior therefore cannot be verified from this artifact. Global installation increases exposure because package lifecycle scripts may execute during installation and the resulting executable is placed in the user's global command environment. This creates a supply-chain trust boundary in which a compromised, replaced, or unexpectedly changed npm release could execute with the installing user's privileges. ### Attack Path 1. An attacker compromises the npm package, its publisher account, or a transitive dependency and publishes a malicious release under the same package name. 2. A user or agent follows the skill instructions and runs `npm install -g apple-mail-search-cli`. 3. Because no version or integrity value is pinned, npm resolves and downloads the attacker-controlled release. 4. Malicious lifecycle code may execute during ins ...[truncated 758 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to an exact, independently reviewed version rather than resolving the latest release. 2. Record and verify package integrity metadata using a lockfile or an equivalent cryptographic checksum. 3. Vendor or bundle the reviewed implementation with the skill so its behavior can be audited together with the documentation. 4. Prefer a project-local installation over a global installation and invoke the binary through an explicitly controlled path. 5. Disable npm lifecycle scripts during installation where compatible with the package, then separately review any required installation steps. 6. Audit the package and its complete transitive dependency tree before distribution, including code that reads the Apple Mail database or invokes AppleScript. 7. Run the utility with the minimum filesystem and automation permissions needed, and document the exact macOS privacy permissions it requires. 8. Establish an update process that reviews new releases before changing the pinned version or integrity value.