T08 · Insecure Dependencies
Warning
- Location
scripts/reddit.ts:1- Finding
Unpinned Runtime Dependency Can Download and Execute Mutable Third-Party Code
- Content
View full analysis
[args] [options] */ ``` `SKILL.md:35-46`: ```markdown Node.js 18+ required (for native `fetch`). No `npm install` needed. ```bash cd /scripts ``` ## CLI Tool ### Search ```bash npx tsx reddit.ts search "" [options] ``` ``` `README.md:56-71`: ```markdown ## Install ### OpenClaw ```bash cd ~/.openclaw/workspace/skills git clone https://github.com/minilozio/reddit-research.git ``` ### Claude Code ```bash mkdir -p .claude/skills cd .claude/skills git clone https://github.com/minilozio/reddit-research.git ``` ## Setup **Node.js 18+** required (for native `fetch`). No API key. No npm install. **Zero dependencies.** ``` `package.json:1-7`: ```json { "name": "reddit-research", "version": "1.0.0", "description": "Reddit research skill for OpenClaw — zero auth, zero dependencies", "private": true, "type": "module" } ``` ### Technical Analysis The documented execution path relies on `npx tsx`, but `tsx` is not declared in `package.json`, pinned to an exact version, or protected by a committed lockfile and integrity metadata. If `tsx` is not already installed, `npx` can resolve, download, cache, and execute a package from the configured npm registry. This behavior contradicts the repeated claims that the project has “zero dependencies” and requires “No npm install.” Users may therefore execute remotely retrieved code without realizing that normal use introduces a third-party runtime dependency. The installation instructions also clone a mutable repository default branch rath ...[truncated 1942 chars]- Remediation
View remediation