T08 · Insecure Dependencies
- Location
SKILL.md:57- Finding
Unpinned Packages May Be Downloaded and Executed Through npx
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 57-64
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: MediumVulnerable Code
bash # 1. TypeScript compilation npx tsc --noEmit # 2. Linting npx next lint # 3. Unit & integration tests npx vitest runThe same unsafe execution pattern also appears in
SKILL.mdwhen invokingnextandvercel, including lines 64, 77, 83, 111, 120, 127, 132-134, 140, 147, and 152.Technical Analysis
The skill directs the agent to execute package-provided commands using
npxwithout an exact package version and without requiring local-only binary resolution. If a requested executable is unavailable in the project's installed dependencies,npxmay resolve a package through the configured package registry, download it, and immediately execute its lifecycle or command code.Consequently, the code executed during a deployment is not necessarily limited to dependencies reviewed and recorded in the repository lockfile. Its behavior can depend on mutable registry state, package-name resolution, local dependency availability, and registry configuration. This creates a software supply-chain exposure consistent with insecure dependency handling.
The risk is particularly significant for the Vercel commands because the process is expected to have access to
VERCEL_TOKEN, as declared inclaw.json. A malicious package executed in that context could read process environment variables, access repository files, make outbound requests, modify source code, or issue deployment-related operations using the privileges available to the agent.Attack Path
- A required command such as
vercel,vitest,next, ortscis absent from the project's locally installed dependencies, or local dependency installation has not yet occurred. - The agent follows
SKILL.mdand invokes the command throughnpx. npxresolves the cor ...[truncated 1716 chars]
- A required command such as
- Remediation
View remediation
Remediation Suggestions
- Declare every required Node.js CLI as an explicit dependency or development dependency with reviewed versions.
- Commit the package manifest and lockfile, and install dependencies using a lockfile-enforcing command such as
npm ci. - Replace download-capable invocations with local-only execution, for example:
bash npx --no-install tsc --noEmit npx --no-install next lint npx --no-install vitest run npx --no-install next build npx --no-install vercel list --token "$VERCEL_TOKEN" - Alternatively, invoke binaries directly from
node_modules/.binor use package-manager commands configured to reject registry downloads during deployment. - Pin the Vercel CLI and other deployment tools to exact reviewed versions rather than relying on the latest registry release.
- Configure an approved registry and enforce lockfile integrity checks in CI.
- Run build and test commands in an isolated environment without production deployment credentials. Expose
VERCEL_TOKENonly to the deployment stage that requires it. - Scope the Vercel token to the minimum required projects and operations, rotate it periodically, and ensure it is not inherited by unrelated package installation or build processes.
- Add a preflight check that fails if required local binaries are missing instead of permitting
npxto retrieve them dynamically.