T08 · Insecure Dependencies
Error
- Location
- SKILL.md:30
- Finding
- Unpinned Remote Backend Installation and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 30–35 **Vulnerability Type**: Untrusted and unpinned third-party dependency execution **Risk Level**: High ```bash git clone https://github.com/Franciscomoney/elevenlabs-moltbot.git cd elevenlabs-moltbot npm install cp .env.example .env # Add your API keys to .env npm start ``` ### Technical Analysis The skill instructs users to clone a mutable personal GitHub repository, install its dependencies, configure service API keys, and execute the resulting backend. The repository is not pinned to a reviewed commit or signed release, and the instructions do not require checksum, signature, lockfile, or provenance verification. Both `npm install` and `npm start` can execute code that is not present in the audited skill package. In particular, package lifecycle scripts may run during installation. Because the remote repository and its dependency graph can change after this skill has been reviewed, subsequent installations may execute materially different code. The backend is expected to receive `ELEVENLABS_API_KEY`, `SUPADATA_API_KEY`, and `OPENROUTER_API_KEY`. Consequently, malicious or compromised backend code would execute in an environment containing valuable credentials. ### Attack Path 1. An attacker compromises the referenced GitHub account, repository, package dependency, or dependency publishing account. 2. The attacker adds malicious code to the backend, an installation lifecycle script, or a transitive dependency. 3. A user follows the documented instructions and clones the repository without pinning a known-good revision. 4. The user runs `npm install`, potentially executing malicious lifecycle scripts. 5. The user places the required API keys in the backend environment and runs `npm start`. 6. The malicious code executes with the user's operating-system privileges and can read the configured API keys, access files available to that account, make outbound network requests, or alter local da ...[truncated 865 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the backend to a specific, reviewed commit hash or cryptographically signed release rather than cloning the mutable default branch. 2. Publish expected checksums or signatures and require users to verify them before installation. 3. Commit and maintain a dependency lockfile, and use `npm ci` to install the exact reviewed dependency versions. 4. Disable package lifecycle scripts with `npm ci --ignore-scripts` where operationally feasible. Review and explicitly allow any scripts that are genuinely required. 5. Add automated dependency, provenance, and integrity scanning to the release process. 6. Run the backend in a restricted container or dedicated low-privilege account with a read-only filesystem where possible. 7. Restrict outbound network access to the explicitly required service endpoints. 8. Use narrowly scoped, revocable API keys with spending limits and rotate them if compromise is suspected. 9. Avoid exposing unrelated credentials or sensitive host directories to the backend process. 10. Document the exact reviewed backend version and provide a reproducible deployment artifact.