T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:28
- Finding
- Unpinned Third-Party npm Package Installation and Execution## Vulnerability Details **File Location**: `SKILL.md`, line 28 **Vulnerability Type**: Unpinned and unverified third-party dependency execution **Risk Level**: Medium ```text - Installation: `npm install -g skill-base-cli`, or `npx skill-base-cli <subcommand>` ``` ### Technical Analysis The Skill directs the Agent to install or execute `skill-base-cli` without specifying an exact, reviewed package version. Both commands resolve the package through the configured npm registry at execution time: - `npm install -g skill-base-cli` installs the currently resolved release globally and may execute npm lifecycle scripts. - `npx skill-base-cli` may download and immediately execute the currently resolved package. The instruction provides no exact version pin, integrity hash, lockfile, registry restriction, or package-publisher verification. Consequently, the code executed by an Agent can differ from the code that existed when this Skill was reviewed. Exploitation could occur through package-maintainer compromise, publication of a malicious package release, registry substitution, dependency confusion in a misconfigured registry environment, or compromise of a transitive dependency. ### Attack Path 1. An attacker compromises the `skill-base-cli` package, one of its dependencies, its publisher account, or a registry used by the target environment. 2. The attacker publishes or serves a malicious version that still resolves under the unpinned package name. 3. A user requests an operation covered by this Skill. 4. Following `SKILL.md`, the Agent runs either the global npm installation command or the `npx` command. 5. npm retrieves the attacker-controlled version. 6. Malicious lifecycle scripts or CLI code execute with the privileges of the account running the Agent. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the privileges of the Agent's operating-system account. This may perm ...[truncated 538 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `skill-base-cli` to an exact version that has undergone security review, for example: ```bash npx --yes skill-base-cli@X.Y.Z <subcommand> ``` 2. Prefer a project-local dependency governed by a committed lockfile instead of global installation. 3. Use a trusted, explicitly configured npm registry and verify package ownership and provenance before execution. 4. Verify package integrity through npm lockfile integrity metadata, signed provenance, or an independently maintained checksum. 5. Disable or carefully control npm lifecycle scripts where operationally possible. 6. Require explicit user confirmation before downloading or executing a package that is not already installed and verified. 7. Run the CLI under a least-privileged account or sandbox with access limited to the files and credentials required for the requested operation. 8. Establish a controlled upgrade process in which newer versions are reviewed and tested before changing the pinned version.