T08 · Insecure Dependencies
Error
- Location
- skill.md:35
- Finding
- Execution of Unpinned Third-Party Packages Through npx<![CDATA[ ## Vulnerability Details **File Location**: `skill.md:35-49`, `skill.md:211-214` **Vulnerability Type**: Unpinned runtime dependency execution **Risk Level**: High ### Evidence ```bash # Install the agentic-wallet skills (one-time) npx skills add coinbase/agentic-wallet-skills ``` ```bash # 1. Start login — sends a 6-digit code to your email npx awal@latest auth login agent@example.com # 2. Verify with the code you received npx awal@latest auth verify <flowId> <otp> # 3. Confirm authentication npx awal@latest status ``` The payment workflow later executes the same mutable package reference: ```bash # Pay and call the analysis endpoint npx awal@latest x402 pay \ "https://api-hoobs.polyox.io/nba/analysis" \ -X POST \ -d '{"date":"2026-02-08","home":"MIN","away":"LAC"}' ``` ### Technical Analysis The documented workflow uses `npx` to retrieve and execute third-party packages at runtime. In particular, `awal@latest` refers to a mutable registry tag rather than a specific reviewed version. The `coinbase/agentic-wallet-skills` installation instruction also does not specify a version, commit, or integrity value. Consequently, the code executed when a user follows these instructions can differ from the code available when the skill was audited. A compromised package publisher, registry account, dependency, or mutable release could introduce arbitrary executable code. Because these commands are involved in authentication and wallet payment operations, the execution context may contain sensitive wallet state, authentication data, environment variables, and access to user files. ### Attack Path 1. An attacker compromises the package publisher, registry account, upstream repository, or a transitive dependency. 2. The attacker publishes a malicious release and assigns it to the `latest` tag, or otherwise modifies the unpinned dependency source. 3. A user or agent follows the skill ins ...[truncated 966 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed package version. 2. Pin the wallet-skills source to an immutable release or commit hash. 3. Use lockfiles and package integrity hashes where the installation mechanism supports them. 4. Install and audit dependencies separately before performing authentication or payment operations rather than allowing implicit runtime installation. 5. Use trusted package registries and verify package ownership, signatures, provenance attestations, and published checksums. 6. Run wallet tooling in a restricted environment with minimal filesystem access, sanitized environment variables, and no unnecessary credentials. 7. Establish a controlled update process in which new dependency versions are reviewed before the pinned version is changed. ]]>