T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:64
- Finding
- Unpinned Runtime Installation of a Third-Party Dependency## Vulnerability Details **File Location**: `SKILL.md`, lines 64-67 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium **Vulnerable snippet**: ```bash # Install the dependency if it is not installed npm install pptxgenjs --prefix /tmp/pptx-pkg ``` ### Technical Analysis The Skill instructs the agent to install `pptxgenjs` at runtime without specifying an exact version, lockfile, or expected integrity hash. Consequently, the package version and transitive dependency graph resolved during execution can differ from those reviewed during the Skill audit. By default, npm packages can execute lifecycle scripts during installation. If the package, one of its transitive dependencies, or the relevant package-distribution channel is compromised, attacker-controlled installation code could execute with the permissions of the agent process. The temporary installation prefix does not prevent lifecycle scripts or subsequently imported package code from accessing other resources available to that process. ### Attack Path 1. An attacker compromises the `pptxgenjs` package, a transitive dependency, or its distribution channel. 2. The user invokes the annual-report generation workflow on a system where the dependency is not already installed. 3. The agent runs the documented unpinned `npm install` command. 4. npm resolves and downloads the currently published package graph rather than a previously audited graph. 5. Malicious lifecycle code can run during installation, or malicious library code can run when the generated Node.js script imports the package. 6. The payload operates with the permissions and resource access of the agent process. ### Impact Assessment Successful exploitation could permit arbitrary code execution under the agent's operating-system account. The affected scope may include generated presentations, user-provided business information, temporary files, environment variab ...[truncated 353 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `pptxgenjs` to an exact reviewed version rather than resolving the latest version at runtime. 2. Maintain a reviewed `package-lock.json` and use `npm ci` to enforce the locked dependency graph. 3. Verify package integrity using the lockfile's integrity metadata or an independently maintained checksum. 4. Use `--ignore-scripts` when package lifecycle scripts are unnecessary. 5. Install dependencies during a controlled build or provisioning stage instead of during each Skill invocation. 6. Use a trusted internal registry or allowlist packages and versions where possible. 7. Run presentation generation in a sandbox with minimal filesystem, environment-variable, credential, tool, and network access. 8. Periodically scan the pinned direct and transitive dependencies for known vulnerabilities and review updates before deployment.