T08 · Insecure Dependencies
Error
- Location
- SKILL.md:6
- Finding
- Unpinned Third-Party Package Executes with Access to Financial Credentials and Trading Functions## Vulnerability Details **File Location**: `SKILL.md:6-9`; related execution and authentication workflow at `setup.md:14-22` **Vulnerability Type**: Unpinned third-party dependency with access to sensitive OAuth tokens and financial operations **Risk Level**: High ### Vulnerable Code `SKILL.md:6-9`: ```yaml install: - kind: node package: robinhood-for-agents bins: [robinhood-for-agents] ``` `setup.md:14-22`: ```bash ### Step 2: Browser Login ```bash bunx robinhood-for-agents login ``` This opens Chrome to the real Robinhood website: 1. Chrome opens to robinhood.com/login 2. User enters email and password 3. Robinhood handles MFA natively (push notification, SMS, etc.) 4. Token captured automatically and saved securely 5. Chrome closes when login is complete ``` ### Technical Analysis The Skill installs and executes `robinhood-for-agents` without specifying an exact package version or integrity hash. The `bunx` authentication command may therefore resolve and execute whichever package version the registry currently serves. This dependency occupies a highly privileged trust position. According to the documented workflow, it intercepts Robinhood OAuth traffic, captures an authenticated token, stores or restores that token through the operating-system keychain, reads sensitive financial information, and exposes methods capable of placing or cancelling stock, option, and cryptocurrency orders. The audited project contains only Markdown instructions and API documentation; it does not include the dependency source, a lockfile, package integrity metadata, or a reproducible build record. Consequently, the dependency's implementation, outbound destinations, token handling, and enforcement of order safeguards cannot be verified from the audited artifact. A malicious or compromised future release could execute before any reviewed version boundary protects the user. Network access and possession o ...[truncated 2470 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `robinhood-for-agents` to an exact, reviewed version rather than resolving the latest registry release. 2. Commit a lockfile containing cryptographic integrity values and require frozen-lockfile installation so dependency resolution cannot drift. 3. Prefer a vendored or otherwise locally reviewable implementation for the authentication and trading client, especially the browser interception and keychain code. 4. Publish signed release artifacts, package provenance, and reproducible build instructions. Verify signatures and integrity before execution. 5. Audit all transitive dependencies and use automated dependency monitoring for publisher changes, known vulnerabilities, and unexpected release activity. 6. Restrict outbound network access to explicitly documented Robinhood domains during authentication and API use. Deny arbitrary third-party destinations where the execution environment supports egress controls. 7. Separate authentication, read-only portfolio access, and trade execution into distinct capabilities. Do not expose order methods to workflows that only require research or portfolio retrieval. 8. Enforce confirmation and account-selection requirements in a trusted wrapper outside the third-party dependency, rather than relying only on Markdown instructions. 9. Avoid printing complete account-profile, account-number, or portfolio responses unless specifically required. Redact sensitive fields before presenting results or retaining logs. 10. Document token revocation procedures and advise users to revoke the Robinhood session immediately if dependency integrity is uncertain.