T08 · Insecure Dependencies
Error
- Location
SKILL.md:17- Finding
Unpinned npm Package Is Executed Through npx on Bot and User Systems
- Content
View full analysis
` 3. `npx health-sync providers --verbose` 4. `npx health-sync sync` 5. `npx health-sync status` User-side command: 1. `npx health-sync init --remote ` ``` `references/setup.md:79-83`: ```bash npx health-sync init remote bootstrap --expires-in 24h ``` `references/setup.md:113-124`: ```bash npx health-sync init remote finish /path/to/archive.enc ``` ```bash npx health-sync init remote finish /path/to/archive.enc \ --target-config /path/to/health-sync.toml \ --target-creds /path/to/.health-sync.creds ``` `references/setup.md:139-142`: ```bash npx health-sync providers --verbose npx health-sync sync npx health-sync status ``` ### Technical Analysis The Skill repeatedly executes the `health-sync` npm package without specifying an exact version or verifying an integrity hash. No lockfile, vendored implementation, package checksum, or package-signing policy is included in the audited project. When an unversioned package is invoked through `npx`, the resolved package can change independently of the reviewed Skill. This creates a supply-chain trust boundary: future registry releases or a compromised publisher account can cause code that was never audited to run under the privileges of the invoking user. The exposure is particularly significant because the package is instruc ...[truncated 2135 chars]- Remediation
View remediation