T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:6
- Finding
- Unpinned HyperFrames CLI and Mutable Skill Update Supply Chain<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:6`, `SKILL.md:70`, `references/transitions.md:69` **Vulnerability Type**: Unpinned external CLI and mutable Skill retrieval **Risk Level**: Medium ### Vulnerable Code ```markdown > **First, keep this skill fresh — confirm with the user before running:** `npx hyperframes skills update remotion-to-hyperframes`. A fast no-op when everything is current; otherwise it refreshes this skill plus the core domain skills it depends on before you rely on them. ``` Additional unpinned commands include: ```markdown npx hyperframes catalog --query "<the effect, in plain English>" --json npx hyperframes add sdf-iris ``` ### Technical Analysis The Skill instructs the agent to invoke `npx hyperframes` without an exact package version or a requirement that the package already be installed from a reviewed lockfile. If the package is unavailable locally, `npx` may retrieve the currently published package from the configured npm registry and execute its CLI with the invoking user's privileges. The update command is particularly sensitive because it replaces the Skill and its dependent instructions before the agent relies on them. User confirmation makes the network operation visible, but it does not authenticate the downloaded content, verify its integrity, or present the changes for review. Consequently, the effective executable code and Skill instructions can change after this project has been audited. Relevant compromise scenarios include: - Compromise of the package publisher or npm account. - Publication of a malicious release under the legitimate package name. - Registry or configuration redirection to an untrusted source. - Compromise of the hosted Skill or catalog content. - A malicious catalog component returned by an otherwise legitimate CLI. ### Attack Path 1. An attacker compromises the `hyperframes` package publication channel, hosted Skill content, or a configured npm registry. 2. The attacker ...[truncated 1159 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the HyperFrames CLI to an exact reviewed version, for example: ```bash npx --yes hyperframes@0.4.15 skills update remotion-to-hyperframes ``` 2. Prefer installing the pinned CLI through a committed lockfile and invoke it with: ```bash npx --no-install hyperframes ... ``` 3. Require signed releases or published checksums and verify downloaded Skill bundles before loading them. 4. Download updates into a staging directory instead of overwriting the active Skill immediately. 5. Present and review a diff of changed Skill instructions and scripts before activation. 6. Pin catalog components to immutable versions or content digests. 7. Run update and catalog commands in a sandbox with restricted filesystem access, a minimized environment, and limited network permissions. ]]>