T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:11
- Finding
- Unpinned Global Third-Party Dependency<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 11–15 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ## Installation Status The package is globally installed as `yahoo-finance`. (Installed via `npm install -g yahoo-finance2`) ``` ### Technical Analysis The skill relies on the community-supported `yahoo-finance2` npm package but documents its installation without an exact version or integrity verification. Consequently, `npm install -g yahoo-finance2` resolves whichever package version is current when installation occurs rather than a previously reviewed release. The global installation mode also gives the installed package broader reach than a project-local dependency. npm packages may execute lifecycle scripts during installation unless those scripts are explicitly disabled. Therefore, a compromised maintainer account, malicious package release, or unexpectedly modified future release could introduce code that executes with the privileges of the user performing the installation. The repository only documents the installation and does not itself contain an installer or execute the command. Exploitation therefore depends on an operator or provisioning system installing the dependency as documented. ### Attack Path 1. An attacker compromises the upstream npm package, its maintainer account, or its release process. 2. The attacker publishes a malicious or backdoored version under the legitimate `yahoo-finance2` package name. 3. An operator provisions the skill using the documented unpinned command: ```bash npm install -g yahoo-finance2 ``` 4. npm resolves and installs the attacker-controlled release. 5. Malicious lifecycle code may execute during installation, or malicious runtime code may execute when the agent invokes `yahoo-finance`. 6. The compromised dependency can manipulate financial results or access resources available to the installing or invok ...[truncated 737 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to an explicitly reviewed version: ```bash npm install -g yahoo-finance2@<reviewed-exact-version> ``` 2. Prefer a project-local installation over a global installation and invoke the pinned binary from that controlled environment. 3. Commit and enforce a lockfile where the deployment model permits it, using deterministic installation such as `npm ci`. 4. Verify package provenance and integrity before deployment, including the publisher, package metadata, release history, and registry integrity hash. 5. Review dependency changes before upgrading and use automated supply-chain scanning for the package and its transitive dependencies. 6. Disable npm lifecycle scripts during installation where compatible: ```bash npm install --ignore-scripts yahoo-finance2@<reviewed-exact-version> ``` 7. Run the CLI under a dedicated, least-privileged account or sandbox with restricted filesystem and network access. 8. Document a tested version and controlled upgrade process in `SKILL.md` rather than directing users to install the latest available release. ]]>