T08 · Insecure Dependencies
Warning
- Location
SKILL.md:12- Finding
Unpinned Third-Party CLI and Unverified Workflow Skill Installation
- Content
View full analysis
-y ``` ``` ### Technical Analysis The Skill declares the npm package `@anygen/cli` without an exact version or integrity hash. Dependency resolution can therefore select a mutable release that differs from the version available when this audit was performed. The Skill also instructs the agent to retrieve and install `anygen-workflow-generate` dynamically. The command uses `-y`, suppressing an interactive approval step, and does not specify a version, content digest, verified source, or signature. Consequently, the effective workflow instructions or executable content may change after review. This creates a supply-chain trust boundary: the security of the local agent environment depends on the npm registry, the AnyGen distribution infrastructure, publisher accounts, and the dynamically installed workflow Skill. Compromise of any of these components could introduce attacker-controlled code or instructions. ### Attack Path 1. An attacker compromises a relevant package publisher account, registry entry, CLI distribution channel, or workflow Skill source. 2. The attacker publishes a malicious replacement or update under the expected package or Skill name. 3. A user invokes this Skill in an environment where `@anygen/cli` or `anygen-workflow-generate` is not already installed. 4. The unpinned package declaration resolves to the attacker-controlled release, or the unattended `anygen skill install ... -y` command downloads th ...[truncated 1172 chars]- Remediation
View remediation