T08 · Insecure Dependencies
- Location
modules/03-precedent.md:9- Finding
Unpinned Remote Package Retrieval and Execution via npx
- Content
View full analysis
Vulnerability Details
File Location:
modules/03-precedent.md:9-12andmodules/03-precedent.md:40-43
Vulnerability Type: Unpinned third-party package execution
Risk Level: HighVulnerable Code:
markdown 1. 从需求中提取关键词（功能域、输入输出、触发场景） 2. 本地搜索：`Glob + Grep` 扫描 `~/.codebuddy/skills/*/SKILL.md` 3. 远程搜索：`npx skills find <query>` 查 skills.sh 4. ClawHub 搜索：`clawhub search <query>`bash # skills.sh npx skills find <query>Technical Analysis
The Skill directs the Agent to invoke an unversioned package through
npx. Depending on the local environment and cache state,npxcan retrieve the package from a remote registry and execute package-controlled code, including installation lifecycle scripts.No package version, lockfile, integrity hash, trusted registry restriction, or provenance check is specified. The Skill also grants access to
Bash, so package code would run with the operating-system privileges and environment inherited by the Agent.Although remote precedent discovery is relevant to the declared functionality, executing a dynamically resolved package is not the minimum privilege necessary for a search operation. A read-only registry API or preinstalled, verified client would provide a narrower trust boundary.
Attack Path
- A user triggers Skill creation or precedent research.
- The Skill loads the precedent-research workflow.
- The Agent runs
npx skills find <query>. npxresolves an unpinned package from the configured package registry or cache.- A compromised, substituted, or otherwise malicious package executes during installation or command startup.
- The package inherits the Agent process's filesystem, environment, and network access.
- Malicious code can read accessible files, inspect environment variables, alter workspace content, or initiate outbound connections.
Impact Assessment
Successful exploitation ...[truncated 504 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace
npxexecution with a documented, read-only registry API where possible. - If a CLI is required, pin an explicitly reviewed package version, such as
package-name@x.y.z. - Commit and enforce a lockfile and verify package integrity and provenance before execution.
- Configure an allowlisted registry rather than inheriting arbitrary package-manager registry settings.
- Disable or ignore package lifecycle scripts where supported.
- Require explicit user approval before downloading or executing a package that is not already installed.
- Run the search client in a restricted environment without secrets, write access outside a temporary directory, or unnecessary network destinations.
- Document the expected package publisher, package identifier, version, and checksum so similarly named packages cannot be substituted silently.
- Replace