T08 · Insecure Dependencies
- Location
examples/starter-kit.md:3- Finding
Mutable External Starter Kit Is Retrieved and Executed Without Integrity Verification
- Content
View full analysis
Vulnerability Details
File Location:
examples/starter-kit.md:3-39
Vulnerability Type: Untrusted and unpinned third-party code execution through a starter-kit workflow
Risk Level: MediumVulnerable Code
markdown If you prefer a more opinionated starting point with pre-configured tooling, styles, and templates, use the [Ghost Theme Starter Kit](https://github.com/frontendweb3/ghost-theme-starter-kit) instead of the minimal theme. Clone it and install dependencies using your preferred package manager: ```bash git clone https://github.com/frontendweb3/ghost-theme-starter-kit.git my-theme cd my-themenpm — default Node.js package manager, comes with Node:
bash npm install npm run devyarn — faster installs with deterministic lockfile:
bash yarn install yarn devpnpm — disk-efficient with strict dependency isolation:
bash pnpm install pnpm devtext The workflow is also made available to new-theme operations by `SKILL.md:35`: ```markdown - Start new themes from the minimum valid structure or `examples/starter-kit.md`. Add context-specific templates only when their layout differs.Technical Analysis
The workflow clones the current default branch of a third-party repository without pinning a reviewed commit or verifying its integrity. It then installs dependencies and runs a development command from the retrieved repository.
Package installation can execute dependency lifecycle hooks such as
preinstall,install, andpostinstall. The subsequentnpm run dev,yarn dev, orpnpm devcommand executes scripts defined by the remotely retrieved project. Consequently, the effective executable payload can change after this Skill has been reviewed.The repository is hosted under a third-party account rather than being bundled with the audited Skill or pinned to an immutable revision. A compromise of the repository, main ...[truncated 1577 chars]
- Remediation
View remediation
Remediation Suggestions
- Prefer a minimal starter template bundled directly in the audited Skill.
- If the external starter kit remains necessary, pin it to a reviewed immutable commit rather than cloning its mutable default branch:
bash git clone --no-checkout https://github.com/frontendweb3/ghost-theme-starter-kit.git my-theme cd my-theme git checkout --detach EXPECTED_COMMIT_SHA - Publish and verify an expected archive checksum or signed commit before using the retrieved files.
- Review
package.json, package-manager configuration, lockfiles, and all lifecycle and development scripts before execution. - Require a committed lockfile and use the package manager's frozen or clean-install mode.
- Perform the initial dependency installation with lifecycle scripts disabled where practical, such as:
bash npm ci --ignore-scripts - Run dependency auditing and inspect any package that requires an install script before enabling scripts.
- Require explicit user confirmation before cloning third-party code, installing dependencies, or running repository-defined commands.
- Execute the workflow in a restricted container or sandbox without unrelated credentials, sensitive mounts, or elevated privileges.