T08 · Insecure Dependencies
- Location
SKILL.md:123- Finding
Uncontrolled Dependency Installation in an Unverified Working Directory
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 123–126
Vulnerability Type: Unverified and unpinned third-party dependency installation
Risk Level: MediumVulnerable Code:
bash # Install dependencies npm install # or pip install -r requirements.txtTechnical Analysis
The setup instructions direct users or agents to install dependencies from package manifests in the current working directory without validating their origin, integrity, or version constraints. The audited Skill does not include a
package.json, package-manager lockfile, orrequirements.txt, so these commands necessarily depend on files supplied by another project or present in an unrelated working directory.Running
npm installcan execute package lifecycle scripts such aspreinstall,install, andpostinstall. Python packages installed through pip may execute build backends or other installation-time logic. Consequently, a malicious or compromised dependency manifest can turn these instructions into a local code-execution path.No malicious dependency, installation payload, or remote source is embedded in the audited repository itself. Exploitation requires the instructions to be followed in a directory containing an attacker-controlled or compromised manifest.
Attack Path
- An attacker supplies or modifies a target project containing a malicious
package.json,requirements.txt, lockfile, or referenced dependency. - A user or automated agent follows the generic setup instructions while its current directory is the attacker-controlled project.
npm installretrieves dependencies and executes an installation lifecycle script, or pip invokes package build or installation logic.- The malicious installation code executes with the privileges of the user or CI process running the command.
- The payload can access files, environment variables, source code, and credentials available to that process ...[truncated 632 chars]
- An attacker supplies or modifies a target project containing a malicious
- Remediation
View remediation
Remediation Suggestions
- Remove generic dependency-installation commands unless the Skill supplies and maintains the corresponding manifests.
- Explicitly require users to change into a verified, trusted project directory before running any package manager.
- Require reviewed lockfiles and use deterministic installation modes, such as
npm ci, instead of unconstrainednpm install. - Disable npm lifecycle scripts with
--ignore-scriptswhen installation hooks are unnecessary. - Pin Python dependencies to reviewed versions and hashes, and install them with hash verification enabled.
- Inspect package manifests, lockfiles, local path dependencies, registry configuration, and installation hooks before installation.
- Run dependency installation in an isolated, least-privileged container or sandbox without production credentials.
- Avoid running package managers as root or with administrative privileges.
- Add an explicit warning that manifests originating from untrusted projects may execute code during installation.