T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:15
- Finding
- Unpinned and Unreviewed External Executable Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 15–20 **Vulnerability Type**: Unpinned npm dependency and indirectly retrieved Docker component **Risk Level**: Medium ### Vulnerable Code ```yaml "install": [ { "id": "mirofish-npm", "kind": "node", "package": "mirofish-cli", "bins": ["mirofish"], "label": "Install MiroFish CLI (npm)", }, ], ``` The related Docker retrieval behavior is documented at `SKILL.md`, lines 43–45: ```bash # 1. Start (automatically pulls the Docker image on first use) mirofish serve start # If ~/.mirofish/.env does not exist, a template is generated for the API key ``` ### Technical Analysis The Skill installs `mirofish-cli` from npm without specifying an exact version or package integrity hash. The installed binary is then trusted to execute all documented operations. The artifact contains only documentation and metadata; it does not include the npm package's source code, lockfile, resolved integrity metadata, or the Docker image definition needed to audit the effective runtime behavior. The CLI also retrieves a Docker image on first use, but the Skill does not identify or pin that image to an immutable digest. Consequently, both the npm package and the container component may change independently after this Skill has been reviewed. This creates a supply-chain trust boundary in which externally mutable code is installed and executed locally. There is no evidence in the audited files that either dependency is currently malicious, so this finding concerns unsafe dependency controls rather than confirmed malicious behavior. ### Attack Path 1. A user installs or activates the Skill. 2. The installation mechanism resolves the unspecified current release of `mirofish-cli` from npm. 3. npm package lifecycle code or the installed `mirofish` executable runs with the user's privileges. 4. The user invokes `mirofish serve start` or `mirofish predict`. 5. The unaudited CLI r ...[truncated 1253 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `mirofish-cli` to an exact reviewed version rather than allowing unconstrained resolution. 2. Record and verify the npm package integrity hash through a lockfile or equivalent integrity mechanism. 3. Verify and document the expected npm publisher, source repository, package provenance, and release-signing process. 4. Review package lifecycle scripts and disable them during installation where they are unnecessary. 5. Explicitly identify the Docker registry, repository, and image used by the CLI. 6. Pin the Docker image by immutable digest rather than a mutable tag. 7. Verify signatures or provenance attestations for both the npm package and Docker image before execution. 8. Run the CLI and container with the minimum required privileges. Do not mount the Docker socket, sensitive host directories, or unrelated credential locations into the container. 9. Prefer runtime secret injection for `LLM_API_KEY`. If `~/.mirofish/.env` is used, create it with permissions no broader than `0600`, exclude it from backups and source control where appropriate, and ensure neither the CLI nor container logs its contents. 10. Provide the resolved CLI and container source or reproducible build information with the Skill so their behavior can be audited together. ]]>