T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:18
- Finding
- Unpinned Third-Party Package Retrieval and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 18–22 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```markdown ## Command Source Run with: ```bash uvx t0cksn1per --help ``` ``` The same unpinned package is also executed in: - `references/commands.md`, lines 6–11, 16–21, and 25–32 - `references/cdp.md`, lines 14–21 Representative command: ```bash PLAYWRIGHT_HEADLESS=0 uvx t0cksn1per run taneda \ --size 3 \ --release-at 11:00 \ --newly-released-only \ --dates 2026-05-27,2026-05-28,2026-05-29,2026-05-30,2026-05-31 \ --exact-times "5:15 PM,7:45 PM" ``` ### Technical Analysis The Skill directs the Agent to use `uvx` to resolve and execute `t0cksn1per` without specifying an immutable version, validating package hashes, using a lockfile, or otherwise verifying the retrieved artifact. Even the documented `--help` command executes package-controlled Python code. Consequently, the effective executable payload is not fixed by the reviewed project. It can change when a new package version is published or if the package distribution account or package index is compromised. The repository contains no local implementation that would allow the behavior of the executed reservation tool to be verified as part of this audit. This is a supply-chain weakness rather than evidence that the current `t0cksn1per` package is malicious. ### Attack Path 1. An attacker compromises the package publisher, package distribution channel, or a future package release. 2. The attacker introduces malicious initialization or CLI code into the version resolved as `t0cksn1per`. 3. A user invokes the Skill, which instructs the Agent to run `uvx t0cksn1per --help` or `uvx t0cksn1per run ...`. 4. `uvx` retrieves and executes the attacker-controlled package version. 5. The malicious code runs under the invoking user or Agent account before or during the requested reservation operation. 6. It can then acces ...[truncated 817 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `t0cksn1per` to a specifically reviewed version rather than allowing `uvx` to resolve the latest available release. 2. Use an audited dependency lockfile and require cryptographic hash verification for all downloaded artifacts and transitive dependencies. 3. Configure `uv` to use an explicitly trusted package index and prevent fallback to untrusted or unintended indexes. 4. Resolve and verify the package before execution. Do not treat `--help` as safe verification because loading the CLI may execute package-controlled code. 5. Consider maintaining a reviewed wrapper or vendored artifact whose integrity can be checked independently before invocation. 6. Run the dependency with least privilege in an isolated environment, limiting filesystem, environment-variable, browser, and network access to what is required. 7. Retain the existing localhost-only CDP URL and explicit opt-in requirement. When CDP is used, launch Chrome with a dedicated temporary profile containing no unrelated authenticated sessions or sensitive browsing data.