T08 · Insecure Dependencies
- Location
SKILL.md:78- Finding
Unpinned Third-Party CLI Is Downloaded and Executed at Runtime
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 78–81
Vulnerability Type: Unpinned runtime dependency execution
Risk Level: MediumVulnerable Code
markdown Use the external CLI through `npx`: ```bash npx @esignglobal/envelope-cli <command>text The same unversioned package invocation is used throughout the documented workflows, including commands that process credentials, contracts, and signer information. ### Technical Analysis The Skill instructs the Agent to execute `@esignglobal/envelope-cli` through `npx` without specifying an exact package version. The project contains no dependency lockfile, package integrity metadata, checksum verification, or enforced local-installation policy. If the package is unavailable locally, `npx` may resolve, download, and execute the package version currently served by the configured npm registry. Consequently, the code that executes can change after this Skill has been audited. Describing the CLI as trusted does not technically bind package identity, version, provenance, or integrity. This creates a software supply-chain exposure. A compromised publisher account, malicious package release, registry compromise, or dependency takeover could cause arbitrary JavaScript to execute with the permissions of the Agent process. ### Attack Path 1. An attacker compromises the npm package, its publisher account, or another relevant part of its dependency supply chain. 2. The attacker publishes a malicious release under `@esignglobal/envelope-cli`, or alters a transitively resolved component. 3. The Agent follows `SKILL.md` and runs an unversioned command such as: ```bash npx @esignglobal/envelope-cli send-envelope --file "/tmp/contract.pdf" --signers '[{"userName":"Bob Smith","userEmail":"bob@example.com"}]' --confirm- If no safe local copy is selected,
npxretrieves and executes the malicious release. - The malicious package executes within the Agent process context and ...[truncated 1002 chars]
- If no safe local copy is selected,
- Remediation
View remediation
Remediation Suggestions
-
Pin the CLI to an exact, reviewed version rather than resolving the current registry release:
bash npx --yes @esignglobal/envelope-cli@1.7.5 <command>Exact version pinning reduces unexpected changes but does not alone provide complete integrity protection.
-
Prefer declaring the CLI in a project manifest and committing the generated lockfile with integrity metadata.
-
Install dependencies using a deterministic command such as:
bash npm ci -
Invoke only the locally installed package and prohibit runtime downloads:
bash npx --no-install @esignglobal/envelope-cli <command>Alternatively, call the verified binary under
node_modules/.bin. -
Verify package provenance, publisher identity, signatures or attestations, and dependency integrity before approving updates.
-
Establish a controlled dependency-update process that includes security review, malware scanning, and regression testing before changing the pinned version.
-
Run the CLI in a sandbox with least-privilege filesystem and network access. Expose only the specific document required for the task.
-
Scope and rotate
ESIGNGLOBAL_APIKEY, and avoid making unrelated credentials available in the CLI process environment. -
Consider using an approved internal package registry or immutable artifact repository so audited package artifacts cannot change after approval.
-