T08 · Insecure Dependencies
Warning
- Location
SKILL.md:115- Finding
Unpinned Remote Project and Dependency Execution
- Content
View full analysis
cd npm install npm run compile ``` `AGENTS.md:52`: ```text - npm dependencies can be imported as needed; update `package.json` accordingly ``` ### Technical Analysis The initialization workflow clones the mutable default branch of a remote repository without pinning it to a reviewed commit SHA or signed release. It then invokes `npm install` and `npm run compile`. An npm installation can execute dependency lifecycle scripts, while the compile command executes scripts controlled by the cloned repository. Consequently, the code executed during initialization can change after the Skill itself has been audited. The supplementary instruction allowing npm dependencies to be imported “as needed” does not impose version pinning, provenance validation, package allowlisting, lockfile enforcement, or lifecycle-script restrictions. This creates a software supply-chain risk. Compromise of the upstream repository, an npm package, a package maintainer account, or a transitive dependency could introduce code that is executed on the local system during setup or compilation. ### Attack Path 1. An attacker compromises the upstream SDK repository, a referenced npm package, a package maintainer account, or a transitive dependency. 2. Malicious code is added to the repository’s mutable default branch, an npm lifecycle script, or a build script. 3. The Agent follows the documented initialization workflow and clones the current upstream content. 4. The Agent runs `npm install`, which may execute malicious lifecycle scripts with the permissions of the invoking ...[truncated 979 chars]- Remediation
View remediation
cd git checkout ``` 2. Document the expected commit SHA and verify it before running installation or build commands. 3. Require a committed lockfile and use `npm ci` instead of `npm install` to enforce deterministic dependency resolution. 4. Use `npm ci --ignore-scripts` when dependency lifecycle scripts are not required. If scripts are required, review and explicitly allow only the necessary scripts before execution. 5. Require exact dependency versions rather than floating ranges. 6. Restrict generated dependencies to a reviewed allowlist and verify package names, maintainers, provenance, integrity hashes, and registry sources. 7. Run installation and compilation in an isolated, least-privileged environment without unnecessary credentials, sensitive environment variables, or access to unrelated workspaces. 8. Amend `AGENTS.md:52` to prohibit adding arbitrary dependencies without explicit approval and supply-chain validation. ]]>