T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:31
- Finding
- Unpinned Third-Party Packages and Mutable Installation Sources## Vulnerability Details **File Location**: `SKILL.md`, lines 31–41 and 124–128 **Vulnerability Type**: Unpinned and unreviewed third-party dependency installation **Risk Level**: Medium ### Vulnerable Code `SKILL.md`, lines 31–41: ```bash neta-cli --version 0.8.0 ``` ```bash npm i @talesofai/neta-skills@latest -g ``` ```bash pnpm add -g @talesofai/neta-skills@latest ``` `SKILL.md`, lines 124–128: ```bash npx skills add talesofai/neta-skills/skills/neta-creative ``` ### Technical Analysis The Skill directs users or agents to install third-party software using the mutable `@latest` package tag and an unpinned repository reference. Although the document displays CLI version `0.8.0`, the installation commands do not enforce that version. Package installation can execute lifecycle scripts and install executable code that is absent from the audited project. Consequently, the effective behavior cannot be verified from `SKILL.md`. Future package releases, repository changes, or compromised transitive dependencies could introduce arbitrary behavior after this audit. Global installation increases exposure by placing third-party executables in shared command locations. The Skill also requires a `NETA_TOKEN` environment variable. While no direct credential exfiltration is present in the reviewed file, subsequently executed dependency code may be able to read that token and other data accessible to the invoking process. ### Attack Path 1. An attacker compromises the package publisher account, source repository, release pipeline, or a transitive dependency. 2. The attacker publishes malicious code under the `latest` package version or modifies the unpinned repository content. 3. A user or agent follows the documented global `npm`/`pnpm` installation command or invokes the `npx skills add` workflow. 4. The package manager retrieves the attacker-controlled version because no immutable version, commit, lockfil ...[truncated 989 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed version, such as `@talesofai/neta-skills@0.8.0`, after independently verifying that release. 2. Pin repository-based installations to an audited immutable commit hash rather than a branch or mutable repository path. 3. Publish and verify package integrity hashes or signed provenance before installation. 4. Avoid global installation. Use a project-local dependency with a lockfile and execute it from an isolated environment. 5. Disable package lifecycle scripts during installation where operationally possible, then explicitly review and authorize any required scripts. 6. Run the CLI with least privilege in a sandbox or container with restricted filesystem and network access. 7. Provide `NETA_TOKEN` only to commands that require it. Use a narrowly scoped, short-lived token and ensure it is not exposed to installation processes. 8. Document the expected API domains and restrict outbound network access to those destinations. 9. Add dependency scanning, release review, and automated verification of transitive dependencies to the maintenance process. 10. Audit the actual CLI and referenced `neta-creative` Skill before recommending their execution.