T08 · Insecure Dependencies
Warning
- Location
- scripts/reddit.ts:1
- Finding
- Unpinned Runtime Dependency Can Download and Execute Mutable Third-Party Code<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:35-46`, `README.md:56-71`, `README.md:85-94`, `scripts/reddit.ts:1-4`, `package.json:1-7` **Vulnerability Type**: Supply-chain risk caused by an undeclared, unpinned runtime dependency **Risk Level**: Medium ### Complete Code Snippets `scripts/reddit.ts:1-4`: ```typescript #!/usr/bin/env npx tsx /** * Reddit Research CLI — zero auth, zero dependencies. * Usage: npx tsx reddit.ts <command> [args] [options] */ ``` `SKILL.md:35-46`: ```markdown Node.js 18+ required (for native `fetch`). No `npm install` needed. ```bash cd <skill-dir>/scripts ``` ## CLI Tool ### Search ```bash npx tsx reddit.ts search "<query>" [options] ``` ``` `README.md:56-71`: ```markdown ## Install ### OpenClaw ```bash cd ~/.openclaw/workspace/skills git clone https://github.com/minilozio/reddit-research.git ``` ### Claude Code ```bash mkdir -p .claude/skills cd .claude/skills git clone https://github.com/minilozio/reddit-research.git ``` ## Setup **Node.js 18+** required (for native `fetch`). No API key. No npm install. **Zero dependencies.** ``` `package.json:1-7`: ```json { "name": "reddit-research", "version": "1.0.0", "description": "Reddit research skill for OpenClaw — zero auth, zero dependencies", "private": true, "type": "module" } ``` ### Technical Analysis The documented execution path relies on `npx tsx`, but `tsx` is not declared in `package.json`, pinned to an exact version, or protected by a committed lockfile and integrity metadata. If `tsx` is not already installed, `npx` can resolve, download, cache, and execute a package from the configured npm registry. This behavior contradicts the repeated claims that the project has “zero dependencies” and requires “No npm install.” Users may therefore execute remotely retrieved code without realizing that normal use introduces a third-party runtime dependency. The installation instructions also clone a mutable repository default branch rath ...[truncated 1942 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Declare `tsx` as an explicit development or runtime dependency at an audited, exact version: ```json { "devDependencies": { "tsx": "4.x.y" } } ``` 2. Commit a lockfile containing resolved versions and integrity hashes. 3. Replace generic `npx tsx` instructions with execution of the locally installed, locked binary, for example: ```bash npm ci --ignore-scripts npm exec --offline -- tsx reddit.ts search "example" ``` If lifecycle scripts are required, document and audit them rather than enabling them implicitly. 4. Alternatively, compile TypeScript into committed or release-generated JavaScript and run it directly with Node.js, eliminating the runtime TypeScript loader. 5. Publish signed releases and instruct users to install a specific release or immutable commit rather than cloning a mutable default branch. 6. Update the README, Skill instructions, package description, and CLI banner to disclose the actual dependency and installation behavior. 7. In controlled deployments, restrict npm registry configuration to an approved registry and verify package provenance before installation. ]]>