T08 · Insecure Dependencies
- Location
`. 7. npm resolves and may download the current package version because no project-local locked dependency exists. 8. Package-controlled code executes with the permissions and environment of the Agent or user. ### Impact Assessment Successful exploitation would provide arbitrary code execution with the privileges of the process running the Skill. Depending on that account's permissions, malicious package code could: - Read or alter the target document and other files accessible to the user. - Access envi ...[truncated 561 chars]:4- Finding
Unpinned Runtime Retrieval and Execution of npm Packages
- Content
View full analysis
Vulnerability Details
File Location:
scripts/autocorrect.ts, lines 4–9
Additional Location:SKILL.md, line 32
Vulnerability Type: Runtime execution of undeclared and unpinned third-party packages
Risk Level: MediumComplete Code Snippets
scripts/autocorrect.ts, lines 4–9:ts export function applyAutocorrect(filePath: string): boolean { const npxCmd = process.platform === "win32" ? "npx.cmd" : "npx"; const result = spawnSync(npxCmd, ["autocorrect-node", "--fix", filePath], { stdio: "inherit", }); return result.status === 0; }SKILL.md, line 32:markdown Scripts in `scripts/` subdirectory. `{baseDir}` = this SKILL.md's directory path. Resolve `${BUN_X}` runtime: if `bun` installed → `bun`; if `npx` available → `npx -y bun`; else suggest installing bun. Replace `{baseDir}` and `${BUN_X}` with actual values.The package manifest does not declare
autocorrect-node:json { "dependencies": { "remark-cjk-friendly": "^1.1.0", "remark-frontmatter": "^5.0.0", "remark-gfm": "^4.0.1", "remark-parse": "^11.0.0", "remark-stringify": "^11.0.0", "unified": "^11.0.5", "unist-util-visit": "^5.1.0", "yaml": "^2.8.2" } }Technical Analysis
The default formatting workflow invokes
autocorrect-nodethroughnpx, but that package is neither declared inscripts/package.jsonnor pinned by the supplied lockfiles. If the executable is unavailable locally,npxmay resolve and download it from the configured npm registry at runtime. The reviewed project therefore does not fully determine which code will execute.The documented runtime fallback similarly uses
npx -y bunwithout an exact version. The-yoption suppresses confirmation, allowing npm to retrieve and execute a mutable package automatically.This creates a supply-chain trust boundary at execution time. A compromised package release, registry account, registry configuration, or dependency-resolution path c ...[truncated 1822 chars]
- Remediation
View remediation
Remediation Suggestions
- Add
autocorrect-nodetoscripts/package.jsonat an exact, reviewed version rather than using a version range. - Regenerate and commit synchronized npm and Bun lockfiles containing that exact dependency and its integrity metadata.
- Invoke only the project-local locked executable, and prevent package-manager behavior that downloads missing packages implicitly. For example, use an npm mode equivalent to
--no-installor resolve the executable from the local dependency directory. - Replace the
npx -y bunfallback with a requirement for a preinstalled, trusted Bun binary, or install a specific Bun release through a verified distribution mechanism with integrity or signature checks. - Fail safely with a clear error when a required executable is unavailable instead of retrieving executable code automatically.
- Use exact versions for direct dependencies and perform periodic dependency provenance, vulnerability, and integrity reviews.
- In sensitive environments, restrict outbound network access during Skill execution and run the formatter in a sandbox with access limited to the intended input and output files.
- Add