T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:114
- Finding
- Unpinned Runtime Download and Execution via npx<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 114-118 **Vulnerability Type**: Unpinned third-party runtime execution **Risk Level**: Medium ### Vulnerable Code ```markdown **Agent Execution Instructions**: 1. Determine this SKILL.md file's directory path as `{baseDir}` 2. Script path = `{baseDir}/scripts/<script-name>.ts` 3. Replace all `{baseDir}` in this document with the actual path 4. Resolve `${BUN_X}` runtime: if `bun` installed → `bun`; if `npx` available → `npx -y bun`; else suggest installing bun ``` ### Technical Analysis The fallback instruction uses `npx -y bun` without specifying an exact package version or validating package integrity. The `-y` option automatically accepts installation and execution, allowing npm to resolve and run the package without additional user confirmation. Consequently, the effective runtime may differ from the version reviewed or previously used. If the upstream package, one of its dependencies, the package registry, or local npm configuration is compromised, attacker-controlled code could run as part of the PDF-generation workflow. The project also imports `pdf-lib` in `scripts/merge-to-pdf.ts`, but the audited directory contains no dependency manifest or committed lockfile. Dependency resolution is therefore not reproducible or integrity-locked within this package. ### Attack Path 1. The user invokes the comic-generation workflow. 2. The workflow reaches the PDF merge stage. 3. A trusted local `bun` executable is unavailable, while `npx` is installed. 4. The Agent follows `SKILL.md` and executes `npx -y bun`. 5. npm resolves and downloads the currently available package and its dependency graph. 6. A compromised or unexpectedly replaced package executes in the Agent's process context. 7. Malicious package code can access resources available to the current operating-system account. This path requires compromise or malicious substitution in the external package supply chain; no evidence ...[truncated 795 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the automatic floating-version fallback: ```markdown If Bun is unavailable, stop and ask the user to install the approved Bun version. ``` 2. If `npx` must be supported, pin an explicitly reviewed version: ```bash npx -y bun@<approved-exact-version> ``` 3. Prefer a trusted, preinstalled Bun executable and verify its version before execution: ```bash bun --version ``` 4. Add a `package.json` declaring exact or tightly constrained dependencies, including `pdf-lib`. 5. Commit the corresponding lockfile and require frozen-lockfile installation so dependency resolution cannot change silently. 6. Where supported, verify package integrity, registry configuration, and provenance before executing downloaded tooling. 7. Avoid unattended package installation during normal Skill execution. Dependency installation should be a separate, explicit setup operation with user approval. ]]>