T08 · Insecure Dependencies
Error
- Location
- SKILL.md:14
- Finding
- Unverified Repository and Dependency Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 14-20 **Vulnerability Type**: Unverified external repository and unsafe dependency installation **Risk Level**: High ### Vulnerable Code ```markdown 2. Clone repository: - `git clone <TEAM_PILOT_REPO_URL> team-pilot` - `cd team-pilot` 3. Install dependencies: - `npm install` 4. Start service: - `npm run up` ``` ### Technical Analysis The Skill directs the user to clone a repository from an unconstrained placeholder URL and immediately run repository-controlled npm commands. It does not identify a trusted repository host, pin an immutable commit, require signature or checksum verification, or instruct the user to inspect the repository before execution. Running `npm install` may execute npm lifecycle scripts defined by the cloned repository or its dependencies, including `preinstall`, `install`, and `postinstall`. Running `npm run up` subsequently executes a command defined by the repository's `package.json`. A malicious repository or compromised dependency can therefore cause arbitrary code to run with the invoking user's privileges. This is a supply-chain risk rather than evidence that the Skill itself contains an embedded malicious payload. The audited package contains only `SKILL.md`; no local scripts or concrete malicious dependencies were present for further verification. ### Attack Path 1. An attacker supplies, substitutes, or compromises the repository referenced by `<TEAM_PILOT_REPO_URL>`. 2. The user follows the Skill and clones the attacker-controlled repository. 3. The user runs `npm install`. 4. A malicious package or repository-defined lifecycle script executes arbitrary commands. 5. The user runs `npm run up`, providing another execution path through a repository-defined script. 6. The malicious code operates with the user's current OS privileges and can access resources available to that account. ### Impa ...[truncated 676 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the repository placeholder with the official HTTPS repository URL on a trusted host. 2. Pin installation instructions to a reviewed, immutable commit hash or cryptographically signed release tag. 3. Require verification of release signatures or published checksums before running repository content. 4. Require and review a committed npm lockfile, then use `npm ci` rather than an unconstrained `npm install`. 5. Initially install with `npm ci --ignore-scripts` where operationally feasible. 6. Review the root package's lifecycle and npm scripts, as well as dependency lifecycle scripts, before enabling script execution. 7. Run dependency auditing and provenance checks, including `npm audit`, while recognizing that automated auditing does not replace source review. 8. Execute the application in an isolated, least-privileged container or disposable environment without production credentials, sensitive mounts, or unnecessary network access. 9. Document the expected `npm run up` command and behavior so users can compare it against the reviewed implementation before execution.