T08 · Insecure Dependencies
- Location
SKILL.md:14- Finding
Unpinned Third-Party Package Installation and Excessive Package-Manager Permissions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:14andSKILL.md:223-234
Vulnerability Type: Supply-chain exposure and excessive installation privileges
Risk Level: MediumVulnerable Code
yaml allowed-tools: Read Write Edit Bash(pip:install) Bash(npm:install) Bash(bun:add)markdown ### Install No SDK required — use your language's built-in HTTP client. ```bash # TypeScript (Bun — built-in fetch, nothing to install) # TypeScript (Node.js — built-in fetch in 18+, nothing to install) # Python pip install requests # or: pip install httpxtext ### Technical Analysis The Skill recommends installing `requests` or `httpx` without pinning versions or verifying package hashes. Package resolution therefore depends on mutable registry state and may introduce an unexpectedly compromised release or transitive dependency. The declared functionality is direct API integration without an SDK. The TypeScript examples explicitly use built-in `fetch`, so the permissions to execute `npm install` and `bun add` are not needed by the documented workflow. Although the Python examples use third-party HTTP clients, equivalent standard-library functionality is available. Consequently, the package-install capabilities exceed the minimum privileges necessary for the Skill's declared purpose. No evidence shows that the named packages are currently malicious, and this Skill does not retrieve and execute arbitrary remote scripts. The risk arises from unnecessarily enabling mutable third-party dependency installation. ### Attack Path 1. An attacker compromises a future release or transitive dependency of an unpinned package, or otherwise influences package resolution. 2. The Skill is invoked for Python API integration. 3. The agent follows `pip install requests` or `pip install httpx` without a version or hash constraint. 4. The package manager retrieves the registry-selected package and executes any applicable installation or import-time behavior wi ...[truncated 932 chars]- Remediation
View remediation
Remediation Suggestions
-
Remove unused package-manager permissions:
yaml allowed-tools: Read Write EditAt minimum, remove
Bash(npm:install)andBash(bun:add), because the documented TypeScript implementations require no packages. -
Prefer Python's standard-library HTTP facilities so the Skill can meet its “no SDK required” objective without installation privileges.
-
If a third-party Python client is necessary:
- Pin an explicitly reviewed version.
- Pin transitive dependencies through a lockfile.
- Require hashes, such as with
pip install --require-hashes -r requirements.txt. - Use an isolated virtual environment.
- Require explicit user approval before installing packages.
- Periodically scan locked dependencies for known vulnerabilities.
-
Restrict installation commands to the exact reviewed package and arguments rather than granting general package-manager installation capabilities.
-
Run dependency installation and generated applications with least privilege, a minimal environment, restricted filesystem access, and constrained outbound network access.
-