T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:27
- Finding
- Unpinned Third-Party Dependencies Can Introduce Mutable Supply-Chain Code## Vulnerability Details **File Location**: `SKILL.md:27-28`, `SKILL.md:389`, `SKILL.md:404`, and `SKILL.md:473` **Vulnerability Type**: Unpinned and immediately executable third-party dependencies **Risk Level**: Medium ### Vulnerable Code At lines 27-28: ```bash pip install claude-agent-sdk npm install @anthropic-ai/claude-agent-sdk ``` At line 389: ```bash npx tsx your-file.ts ``` At line 404: ```bash npm install @anthropic-ai/claude-agent-sdk ``` At line 473: ```bash npm install -D typescript@latest ``` ### Technical Analysis The Skill directs users to install third-party packages without specifying reviewed, exact versions or integrity constraints. Dependency resolution therefore depends on mutable package-registry state at installation time. The explicit use of `typescript@latest` guarantees that the selected package version can change over time. The `npx tsx` instruction is especially sensitive because, when `tsx` is not already installed locally, `npx` may retrieve the currently resolved package from the registry and execute its command immediately. Package installation may also execute lifecycle scripts under the privileges of the developer running the command. No evidence shows that the named packages are currently malicious. The security defect is that the instructions do not ensure that users receive the same reviewed artifacts, leaving the workflow exposed to registry-account compromise, malicious future releases, compromised transitive dependencies, or dependency-resolution manipulation. ### Attack Path 1. An attacker compromises a publisher or registry account, or introduces malicious code into a future direct or transitive dependency release. 2. The registry serves the compromised release under the unversioned/default range, the `latest` tag, or the version dynamically selected by `npx`. 3. A developer follows the Skill and runs one of the documented installation or `npx` co ...[truncated 1033 chars]
- Remediation
- ## Remediation Suggestions 1. Replace unversioned package commands with exact, reviewed versions. Avoid mutable tags such as `latest`. 2. Generate and commit ecosystem lockfiles, such as `package-lock.json` or an equivalent npm lockfile, and a hash-locked Python requirements file. 3. In automated environments, use reproducible installation commands such as `npm ci` rather than commands that can update dependency resolution. 4. Install `tsx` as a pinned development dependency and invoke the local locked binary instead of allowing `npx` to download an unresolved package: ```bash npm install --save-dev --save-exact tsx@REVIEWED_VERSION npm exec --offline -- tsx your-file.ts ``` 5. Pin the Claude Agent SDK and TypeScript to versions that have been reviewed and tested: ```bash npm install --save-exact @anthropic-ai/claude-agent-sdk@REVIEWED_VERSION npm install --save-dev --save-exact typescript@REVIEWED_VERSION ``` 6. For Python, use an exact version with verified hashes, preferably through a generated requirements file: ```text claude-agent-sdk==REVIEWED_VERSION --hash=sha256:EXPECTED_HASH ``` 7. Review transitive dependencies, enable registry provenance and integrity verification where available, and run dependency vulnerability scanning in CI. 8. Disable package lifecycle scripts during installation where they are unnecessary, then explicitly permit only reviewed build steps. 9. Execute dependency installation with least privilege and avoid exposing unrelated production secrets to development or build processes.