T08 · Insecure Dependencies
Error
- Location
SKILL.md:31- Finding
Unpinned Remote Package Download and Execution Through npx
- Content
View full analysis
" ``` **Search for context:** ```bash npx -y @satori-sh/cli@latest search "" ``` ``` A subsequent example also omits an explicit package version: ```bash npx -y @satori-sh/cli search "Flamingo project tech stack" ``` ### Technical Analysis The Skill instructs the Agent to use `npx -y` to download and execute a third-party package without interactive confirmation. The `@latest` tag is mutable, while the command without a version resolves according to the package registry's current metadata. Consequently, the code executed by the Skill can change after the Skill itself has been reviewed. No lockfile, exact version, package integrity value, vendored artifact, or release verification procedure is provided. The `-y` option also suppresses the normal installation confirmation, making remote package retrieval and execution automatic. This creates a supply-chain trust boundary in which compromise of the package publisher, package registry, release pipeline, or a future package version could result in arbitrary code execution under the local Agent user's identity. ### Attack Path 1. An attacker compromises the `@satori-sh/cli` publisher account, release pipeline, or package registry entry. 2. The attacker publishes a malicious version and assigns it to `latest`, or otherwise changes the version resolved by the unversioned command. 3. The Agent follows `SKILL.md` and invokes `npx -y`. 4. `npx` downloads the attacker-controlled package without requesting user confirmation. 5. Package lifecycle code or CLI entry-point code executes with the permissions of the user running the Agent. 6. The malicious code can access resources available to that user before returning plausible CLI output to conc ...[truncated 814 chars]- Remediation
View remediation