T08 · Insecure Dependencies
Error
- Location
- SKILL.md:35
- Finding
- Unpinned Third-Party Package Execution Through npx## Vulnerability Details **File Location**: `SKILL.md`, lines 35-37 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: High ```bash npx @claws-shield/cli intel "capybara codename" npx @claws-shield/cli intel "tengu feature flags" npx @claws-shield/cli intel "unreleased tools" ``` ### Technical Analysis The documented commands instruct users to execute `@claws-shield/cli` through `npx` without specifying an exact package version. Depending on the local environment and npm cache, `npx` may resolve and download the current package release from the configured npm registry before executing it. The project does not include a package manifest, lockfile, integrity metadata, vendored implementation, or other mechanism that binds these commands to the package version reviewed when the Skill was published. Consequently, the code executed by users can change independently of the audited Skill. Package lifecycle scripts and the CLI entry point may run code with the invoking user's operating-system permissions. The local wrapper in `scripts/query-intel.mjs` also imports `@claws-shield/intel` and `@claws-shield/core`, but the source and pinned versions of those dependencies are not included in the supplied project. Their behavior therefore could not be verified during this audit. ### Attack Path 1. An attacker compromises the npm account, publication pipeline, or source used to publish `@claws-shield/cli`, or otherwise causes a malicious release to be resolved through the user's configured registry. 2. The attacker publishes a modified package version containing malicious lifecycle or CLI code. 3. A user follows one of the documented unversioned `npx` commands. 4. `npx` resolves the mutable package release and, when it is not already available locally, downloads it from the registry. 5. npm lifecycle code or the package CLI executes under the user's account. 6. The malicious package can access resources available t ...[truncated 909 chars]
- Remediation
- ## Remediation Suggestions 1. Replace unversioned package execution with an audited, exact package version, such as `@claws-shield/cli@x.y.z`. 2. Add a `package.json` and committed lockfile containing integrity hashes for all direct and transitive dependencies. 3. Install dependencies through a reproducible process such as `npm ci`, rather than resolving mutable versions during each invocation. 4. Review all direct and transitive dependency sources before pinning them, including `@claws-shield/cli`, `@claws-shield/intel`, and `@claws-shield/core`. 5. Disable dependency lifecycle scripts where they are unnecessary, for example by using `npm ci --ignore-scripts`, and explicitly document any scripts that must remain enabled. 6. Prefer bundling or vendoring the minimal query implementation and required static data so that all executable behavior is present in the auditable Skill package. 7. Verify published package provenance and integrity in CI, and require review before updating dependency versions or lockfile entries. 8. Execute the query component with least privilege, without unnecessary secrets in its environment and with filesystem and network access restricted where practical.