T08 · Insecure Dependencies
Error
- Location
- SKILL.md:14
- Finding
- Unpinned npm Package Execution and Automatic Global Skill Updates<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:14`, `SKILL.md:67`, `SKILL.md:84-90`, `catalog-map.md:6-16`, `agents/builder.md:9-10` **Vulnerability Type**: Unpinned third-party package execution and mutable dependency retrieval **Risk Level**: High ### Vulnerable Code ```markdown > **First, keep this skill fresh — confirm with the user before running:** `npx hyperframes skills update motion-graphics`. A fast no-op when everything is current; otherwise it refreshes this skill plus the core domain skills it depends on before you rely on them. ``` ```bash PROJECT_DIR="${MOTION_GRAPHICS_DIR:-videos/<project-name>}" mkdir -p "$(dirname "$PROJECT_DIR")" npx hyperframes init "$PROJECT_DIR" --non-interactive --example=blank --skill=motion-graphics ``` ```markdown `init` checks the installed skills against the latest on GitHub and updates the global set if any are out of date. ``` The same unpinned package is used for catalog searches, block installation, validation, preview, rendering, and feedback: ```markdown npx hyperframes catalog --query "<the move, in plain English>" --json npx hyperframes add <block> npx hyperframes feedback --search-miss "<query>" --wanted "<the move>" --tier <tier from the envelope> ``` ### Technical Analysis The workflow repeatedly executes `npx hyperframes` without an exact version, lockfile, integrity hash, or package signature. When the package is not already available in an appropriate local installation, `npx` can download and execute the package currently published under that registry name. The resulting execution is therefore not restricted to the implementation reviewed during this audit. The effective package can change after review because of a new release, compromised publisher account, registry compromise, dependency compromise, or package-name takeover. The initialization operation adds further exposure because it is documented as updating a global set of installed Skills. Downloaded catalog blocks are ...[truncated 1898 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every `npx` invocation to an audited exact version, for example: ```bash npx --yes hyperframes@X.Y.Z ... ``` 2. Install dependencies through a project-level manifest and committed lockfile rather than resolving them dynamically for each execution. 3. Use `npm ci --ignore-scripts` where lifecycle scripts are unnecessary, and explicitly audit scripts before allowing them. 4. Verify package provenance, signatures, and registry integrity. Record expected package tarball hashes. 5. Separate Skill updates from normal initialization. Never implicitly update global Skills as a side effect of creating a project. 6. Require explicit user approval that identifies the exact old and new versions before updating global content. 7. Pin catalog blocks by immutable version or content digest and verify their hashes before insertion. 8. Run third-party tooling in a restricted container or sandbox with minimal filesystem access, no unnecessary credentials, and controlled network egress. 9. Re-audit downloaded Skill and catalog content before executing or rendering it. ]]>