T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:26
- Finding
- Unpinned Remote npm Package Execution via Mutable latest Tag<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 26–30 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```bash npx @vincentai/cli@latest trade-manager health # Expected: {"status":"ok","version":"0.1.0"} npx @vincentai/cli@latest trade-manager status --key-id <KEY_ID> ``` The same `npx @vincentai/cli@latest` pattern is repeated for trading operations throughout `SKILL.md`, including rule creation, modification, cancellation, position retrieval, event retrieval, and Polymarket betting. ### Technical Analysis The documentation directs users or agents to execute `@vincentai/cli` directly from npm through `npx` while selecting the mutable `latest` distribution tag. The project does not include a lockfile, integrity hash, vendored executable, or exact reviewed package version. Because the npm registry controls which release the `latest` tag resolves to, the effective executable can change after this Skill has been audited. `npx` may download and immediately run that changed package with the privileges and environment of the invoking user. This is particularly sensitive because the CLI receives Vincent key identifiers and trading metadata and is used to configure automated `SELL_ALL` actions. Although the network access and trading authority are consistent with the Skill's declared functionality, retrieving an unpinned executable is not the minimum supply-chain privilege necessary to provide that functionality. A fixed, verified release would be sufficient. No evidence establishes that the current package is malicious. The vulnerability is the unsafe and mutable dependency-execution mechanism. ### Attack Path 1. An attacker compromises the npm package, a package-maintainer account, the publication pipeline, or control of the mutable `latest` tag. 2. The attacker publishes a malicious version and causes `@vincentai/cli@latest` to resolve to it. 3. A user or agent follows th ...[truncated 1373 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace `@vincentai/cli@latest` with an exact, reviewed version, for example: ```bash npx --yes @vincentai/cli@0.1.0 trade-manager health ``` 2. Verify the selected release before recommending it, and update the pinned version only after security review and compatibility testing. 3. Provide an installation workflow backed by a lockfile and npm integrity metadata. In controlled environments, use `npm ci` rather than resolving a mutable package during each invocation. 4. Where feasible, distribute a signed release or publish expected package checksums and verify them before execution. 5. Run the CLI under a dedicated, minimally privileged account with access only to the credentials and files required for trading operations. 6. Keep trading credentials out of command-line arguments when the CLI supports safer alternatives, such as protected environment injection or a restricted credential store. 7. Enforce server-side authorization, transaction limits, explicit approval requirements for high-impact sales, comprehensive audit logging, and credential revocation procedures. 8. Remove all uses of `@latest` from the documented health, status, rule-management, position, event, and betting commands so that every execution resolves to the same reviewed implementation. ]]>