T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:10
- Finding
- Unpinned Third-Party Package Execution Through npx## Vulnerability Details **File Location**: `SKILL.md`, lines 10–17 **Vulnerability Type**: Unpinned and automatically executed third-party dependency **Risk Level**: Medium ### Vulnerable Code ```markdown ## Command policy Prefer `yapi` command. If missing, fallback to one-shot npx without forcing global install: ```bash yapi -h # fallback: npx -y @leeguoo/yapi-mcp -h ``` In command examples below, `yapi` can be replaced by `npx -y @leeguoo/yapi-mcp`. ``` ### Technical Analysis The documented fallback invokes `@leeguoo/yapi-mcp` through `npx -y` without specifying an exact package version or verifying package integrity. Consequently, npm resolves the package to whatever version is current under the applicable registry and configuration when the command runs. The `-y` option suppresses installation confirmation, enabling newly downloaded package code to execute without an explicit user approval step. npm package lifecycle behavior and the invoked CLI entry point can execute code with the permissions of the account running the agent. The effective code may therefore change after the skill has been reviewed. This creates a supply-chain exposure rather than evidence that the named package is currently malicious. Exploitation would require compromise or malicious alteration of the package, its publisher account, its dependency chain, or the package registry/resolution environment. ### Attack Path 1. The agent attempts to use the preferred local `yapi` executable, but it is unavailable. 2. Following the skill instructions, the agent runs: ```bash npx -y @leeguoo/yapi-mcp -h ``` 3. npm resolves an unpinned version from the configured registry and downloads it and any required dependencies. 4. A compromised package version, dependency, publisher account, or registry response supplies attacker-controlled code. 5. Package lifecycle code or the CLI entry point executes under the agent user's identity. 6. The malicious code accesses resources available ...[truncated 654 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the package to a reviewed exact version rather than allowing mutable registry resolution: ```bash npx -y @leeguoo/yapi-mcp@X.Y.Z -h ``` 2. Prefer installing the dependency through a committed lockfile with verified integrity metadata, followed by execution without downloading: ```bash npx --no-install @leeguoo/yapi-mcp -h ``` 3. Remove `-y` where practical so that an unexpected installation requires explicit approval. 4. Document a trusted registry and enforce npm configuration that prevents dependency-confusion resolution through untrusted registries. 5. Review the pinned package, transitive dependencies, lifecycle scripts, and published provenance before approval. 6. Run the CLI with least privilege in a sandbox or container, limiting filesystem and network access to the resources necessary for YApi operations. 7. Restrict access to YApi authentication caches and avoid exposing unrelated credentials or sensitive environment variables to the CLI process.