T08 · Insecure Dependencies
Warning
- Location
SKILL.md:19- Finding
Unpinned Remote Package Execution Through npx
- Content
View full analysis
"` 2. Confirm cost and constraints with the user (`--max-cost`, budget, allowlist) 3. `npx agentspend pay --method ... --header ... --body ... --max-cost ...` ## Setup ```bash npx agentspend configure ``` ``` ### Technical Analysis The Skill directs the Agent to execute `agentspend` through `npx` without specifying an exact package version. If the package is not already available locally, `npx` can retrieve and execute the version currently published in the npm registry. Consequently, the code executed by an Agent following these instructions is not necessarily the audited source. A later compromised, malicious, or unexpectedly changed package release could replace the effective implementation without any modification to the Skill itself. This is a supply-chain trust issue rather than evidence that the currently reviewed package is malicious. The reviewed `package.json` uses ordinary npm dependencies and contains no lifecycle scripts, but the unpinned `npx` workflow remains mutable after review. ### Attack Path 1. An attacker compromises the npm publisher account, registry package, or a future package release. 2. The attacker publishes a modified version of `agentspend` containing malicious executable code. 3. An Agent follows the Skill's default workflow and invokes an unversioned command such as `npx agentspend search`. 4. If no suitable local package is present, `npx` downloads the currently resolved package version. 5. The downloaded package executes with the privileges of the user running the Agent. 6. Malicious code could access user-readable files, environment variables, AgentSpend credentials, and network resources available to that account. ### Impact Assessment Successful exploi ...[truncated 465 chars]- Remediation
View remediation
" npx --yes agentspend@0.2.2 configure ``` 2. Prefer installing dependencies from a committed lockfile and invoking the locally installed binary: ```bash npm ci ./node_modules/.bin/agentspend search "" ``` 3. Publish and verify package integrity metadata or signatures where supported. 4. Add an update-review process so version changes require a new security review before the Skill instructions are updated. 5. Avoid semver ranges for security-sensitive runtime dependencies when producing a reproducible audited artifact. ]]>