T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:69
- Finding
- Unpinned npm Package Is Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 69 and 96 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code At line 69: ```text npx -y @sandbaseai/cli connect --client <client-id> ``` At line 96: ```text npx -y @sandbaseai/cli mcp-bridge --client <client-id> ``` ### Technical Analysis The Skill directs the Agent to execute `@sandbaseai/cli` through `npx` without specifying an immutable package version. When the package is not already available locally, `npx` may download the latest registry release and immediately execute it. The `-y` option suppresses npm's package-installation confirmation. Because the dependency is not pinned, the code executed during a future Skill invocation may differ from the code available when the Skill was audited. The project contains no lockfile, integrity digest, vendored implementation, or other mechanism that establishes the exact package artifact to execute. The setup and bridge commands may also resolve different releases if invoked at different times. The audit did not establish that the current package is malicious. The vulnerability is the mutable supply-chain trust boundary created by downloading and executing an unpinned package. ### Attack Path 1. An attacker compromises the npm publisher account, package publication pipeline, registry delivery path, or a future package release. 2. The attacker publishes a malicious release under the legitimate `@sandbaseai/cli` package name. 3. A user approves SandBase setup, or the configured MCP bridge is subsequently launched. 4. `npx -y` resolves and downloads the attacker-controlled latest release without presenting an installation confirmation. 5. The malicious package executes with the privileges and environment of the user running the Agent or MCP client. ### Impact Assessment Successful exploitation could permit arbitrary code execution with the invoking user's operating-system privile ...[truncated 615 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the CLI to a reviewed, exact version in both commands: ```text npx -y @sandbaseai/cli@<reviewed-version> connect --client <client-id> ``` ```text npx -y @sandbaseai/cli@<reviewed-version> mcp-bridge --client <client-id> ``` 2. Ensure setup and bridge execution use the same approved version so that later bridge launches cannot silently select a different release. 3. Verify the selected release through npm integrity metadata, a lockfile, or an equivalent cryptographic artifact-verification mechanism. 4. Establish a controlled update process in which new versions are reviewed and tested before the pinned version is changed. 5. Where operationally practical, install the verified artifact through a managed dependency workflow rather than allowing `npx` to resolve mutable registry content during each invocation. 6. Avoid automatic installation acceptance where user confirmation can be retained without disrupting the required workflow. ]]>