T08 · Insecure Dependencies
Warning
- Location
- README.md:20
- Finding
- Unpinned Remote Packages and Repository Content Are Executed Locally<![CDATA[ ## Vulnerability Details **File Location**: `README.md:20`, `README.md:46`, `references/security-boundaries.md:39`, `skills/kb-review/SKILL.md:142` **Vulnerability Type**: Unpinned dependency and remote package execution **Risk Level**: Medium ### Vulnerable Code `README.md:20`: ```bash npx skills add lee-agi/agent-os-asset -g -y ``` `README.md:46`: ```bash uvx --from pytest pytest -q ``` `references/security-boundaries.md:39`: ```bash PYTHONDONTWRITEBYTECODE=1 uvx --from pytest pytest -q -p no:cacheprovider ``` `skills/kb-review/SKILL.md:142`: ```bash uvx --from pytest pytest -q test/kb_review ``` ### Technical Analysis The documented commands resolve remote npm, repository, or Python package content without an immutable version, commit identifier, lockfile, or integrity hash. The `npx` command additionally uses `-g -y`, creating an unattended global installation path. The effective code executed or installed can therefore change after this Skill version has been audited. The `uvx --from pytest` commands similarly resolve a mutable package version and execute its console entry point in a generated environment. This does not establish that the current upstream packages are malicious. The vulnerability is the lack of reproducible dependency selection and integrity verification, which exposes users to package-registry compromise, upstream account takeover, malicious future releases, and repository reference changes. ### Attack Path 1. An attacker compromises the relevant package registry entry, upstream repository, maintainer account, or dependency publication process. 2. The attacker publishes malicious content under the mutable package or repository reference used by the documented command. 3. A user follows the project documentation and runs the `npx` or `uvx` command. 4. The package manager downloads the changed content without verifying it against a project-controlled lockfile or expected digest. 5. The downloaded package or install ...[truncated 740 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every remotely resolved package to an exact, reviewed version: ```bash uvx --from 'pytest==<reviewed-version>' pytest -q ``` 2. Pin repository installation sources to an immutable commit hash or signed release rather than a mutable owner/repository reference. 3. Publish and verify cryptographic checksums or signatures for installed Skill releases. 4. Add appropriate lockfiles and require integrity-checked, reproducible dependency restoration in release and CI workflows. 5. Avoid unattended global installation. Prefer an isolated local environment and remove `-g -y` unless global installation is strictly necessary and separately approved. 6. Document the exact package version, repository commit, expected digest, and provenance verification procedure. 7. Where possible, separate download from execution so users can inspect and verify retrieved content before running it. ]]>