T08 · Insecure Dependencies
Error
- Location
- SKILL.md:87
- Finding
- Unpinned and Inconsistently Named Runtime Dependency## Vulnerability Details **File Location**: `SKILL.md`, lines 87–96 **Vulnerability Type**: Supply-chain risk from remote execution of an unpinned npm package **Risk Level**: High ### Vulnerable Code ```bash # zero-config (mock provider — no API key required) AVATAR_PROVIDER=mock npx avatar-runtime # with Live2D local bridge npm run dev:live2d-cubism-bridge # terminal A — bridge on :3755 AVATAR_PROVIDER=live2d LIVE2D_ENDPOINT=http://127.0.0.1:3755 npx avatar-runtime # terminal B # with VRM 3D avatar (free models from https://hub.vroid.com — place .vrm in assets/vrm/slot/) npm run dev:vrm-bridge # terminal A — asset server on :3756 AVATAR_PROVIDER=vrm npx avatar-runtime # terminal B ``` The same unpinned command also appears at `SKILL.md:277` and `SKILL.md:310`. By contrast, `references/WEB-EMBEDDING.md:35` identifies the package using the scoped name: ```js const AvatarWidget = require('@acnlabs/avatar-runtime/widget'); ``` ### Technical Analysis The documented `npx avatar-runtime` command may download and immediately execute the latest version of an unscoped npm package. Neither an exact version nor an artifact integrity value is specified. Consequently, the code reviewed by a user can differ from the code later resolved and executed by npm. The unscoped executable name is also inconsistent with the scoped package name `@acnlabs/avatar-runtime` shown in the embedding reference. This creates package-name confusion risk: users may review or intend to trust the scoped package while `npx` resolves a different unscoped package. npm package installation and runtime code can execute arbitrary code under the invoking user's account. Depending on provider configuration, the process may also inherit sensitive environment variables such as `HEYGEN_API_KEY` and `KUSAPICS_API_KEY`. The Skill's recommendation to review the source does not cryptographically bind that reviewed source to the do ...[truncated 1637 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the unscoped package command with the verified canonical scoped package and an exact version, for example: ```bash npx --yes @acnlabs/avatar-runtime@0.2.1 ``` 2. Confirm that the package version matches the Skill documentation and verified upstream release before execution. 3. Prefer a local, lockfile-controlled installation: ```bash npm install --save-exact @acnlabs/avatar-runtime@0.2.1 npm ci ``` Commit `package-lock.json` and preserve npm integrity metadata. 4. Verify package publisher identity, npm provenance, release signatures where available, and the relationship between the registry artifact and the reviewed source repository. 5. Run the package in a sandbox or container with: - A read-only or narrowly scoped filesystem. - No unnecessary host mounts. - Restricted outbound network access. - A non-privileged user. - Only the provider credentials required for the selected operation. 6. Avoid exposing credentials globally in a shell session. Supply narrowly scoped, short-lived credentials only to a verified process, and rotate them if an untrusted package may have received them. 7. Pin all referenced asset-download scripts and external assets to reviewed versions and cryptographic digests. 8. Make the package name consistent throughout `SKILL.md` and `references/WEB-EMBEDDING.md` so the package executed is the same package users are instructed to review.