T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:78
- Finding
- Unpinned Third-Party CLI Is Downloaded and Executed at Runtime## Vulnerability Details **File Location**: `SKILL.md`, lines 78–81 **Vulnerability Type**: Unpinned runtime dependency execution **Risk Level**: Medium ### Vulnerable Code ```markdown Use the external CLI through `npx`: ```bash npx @esignglobal/envelope-cli <command> ``` ``` The same unversioned package invocation is used throughout the documented workflows, including commands that process credentials, contracts, and signer information. ### Technical Analysis The Skill instructs the Agent to execute `@esignglobal/envelope-cli` through `npx` without specifying an exact package version. The project contains no dependency lockfile, package integrity metadata, checksum verification, or enforced local-installation policy. If the package is unavailable locally, `npx` may resolve, download, and execute the package version currently served by the configured npm registry. Consequently, the code that executes can change after this Skill has been audited. Describing the CLI as trusted does not technically bind package identity, version, provenance, or integrity. This creates a software supply-chain exposure. A compromised publisher account, malicious package release, registry compromise, or dependency takeover could cause arbitrary JavaScript to execute with the permissions of the Agent process. ### Attack Path 1. An attacker compromises the npm package, its publisher account, or another relevant part of its dependency supply chain. 2. The attacker publishes a malicious release under `@esignglobal/envelope-cli`, or alters a transitively resolved component. 3. The Agent follows `SKILL.md` and runs an unversioned command such as: ```bash npx @esignglobal/envelope-cli send-envelope --file "/tmp/contract.pdf" --signers '[{"userName":"Bob Smith","userEmail":"bob@example.com"}]' --confirm ``` 4. If no safe local copy is selected, `npx` retrieves and executes the malicious release. 5. The malicious package executes within the Agent process context and ...[truncated 1002 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the CLI to an exact, reviewed version rather than resolving the current registry release: ```bash npx --yes @esignglobal/envelope-cli@1.7.5 <command> ``` Exact version pinning reduces unexpected changes but does not alone provide complete integrity protection. 2. Prefer declaring the CLI in a project manifest and committing the generated lockfile with integrity metadata. 3. Install dependencies using a deterministic command such as: ```bash npm ci ``` 4. Invoke only the locally installed package and prohibit runtime downloads: ```bash npx --no-install @esignglobal/envelope-cli <command> ``` Alternatively, call the verified binary under `node_modules/.bin`. 5. Verify package provenance, publisher identity, signatures or attestations, and dependency integrity before approving updates. 6. Establish a controlled dependency-update process that includes security review, malware scanning, and regression testing before changing the pinned version. 7. Run the CLI in a sandbox with least-privilege filesystem and network access. Expose only the specific document required for the task. 8. Scope and rotate `ESIGNGLOBAL_APIKEY`, and avoid making unrelated credentials available in the CLI process environment. 9. Consider using an approved internal package registry or immutable artifact repository so audited package artifacts cannot change after approval.