T08 · Insecure Dependencies
- Location
SKILL.md:15- Finding
Unpinned Global Package Installation and Unsafe Token Disclosure
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 15–18
Vulnerability Type: Unpinned third-party executable dependency and bearer-token exposure
Risk Level: MediumVulnerable Code
bash # Method 1: Obtain a token through CLI login npm install -g pixshop pixshop login cat ~/.pixshop-config.json | jq '.accessToken'Technical Analysis
The setup instructions install and execute the latest available
pixshopnpm package globally without pinning a reviewed version, verifying package integrity, or identifying a trusted publisher. Because npm packages can execute lifecycle scripts during installation, compromise of the package, publisher account, or distribution channel could result in arbitrary code execution under the installing user's account.A global installation unnecessarily expands the dependency's reach and persistence within the user's command environment compared with an isolated, version-pinned invocation.
The instructions also print the Pixshop bearer token to standard output. This may expose the credential through terminal history, command output capture, CI logs, screen sharing, or AI-agent transcripts. Although sending bearer tokens and user-provided media to
https://pixshop.appis necessary for the declared remote API integration, displaying the credential is not required.Attack Path
- An attacker compromises the npm package, its publisher account, or a future unreviewed release.
- A user follows the Skill instructions and runs
npm install -g pixshop. - npm downloads the attacker-controlled release and may execute its lifecycle scripts.
- The malicious package runs with the user's privileges and can access files and credentials available to that account.
- Independently, the user runs the token-display command.
- The bearer token is captured in terminal output, logs, or an agent transcript.
- A party with access to that output reuses the token against ...[truncated 812 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin the CLI to a specifically reviewed version rather than installing the latest release implicitly.
- Document the official npm package name, publisher identity, registry, and expected integrity information.
- Prefer an isolated, non-global execution method or a locked project dependency over
npm install -g. - Review package lifecycle scripts and disable them during installation where compatible with the CLI.
- Do not print bearer tokens to standard output. Provide instructions that load the token directly into a protected environment variable or secret manager.
- Ensure token-bearing output is excluded from shell tracing, CI logs, debugging output, and agent transcripts.
- Restrict permissions on
~/.pixshop-config.jsonto the owning user and document secure token revocation and rotation. - Warn users before uploading personal, biometric, or otherwise sensitive images to the remote service, and require explicit confirmation when appropriate.