T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:12
- Finding
- Unpinned Third-Party Packages Executed Through npx<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:12-15` and `SKILL.md:100-101` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```markdown | markdownlint-cli2 | cli | No | `npx markdownlint-cli2` (no install needed, used in step 6) | | markdown-lint | skill | No | Included in `npx skills add niracler/skill` (for repo setup) | ``` ```bash npx markdownlint-cli2 article.md npx markdownlint-cli2 --fix article.md ``` ### Technical Analysis The documented commands execute third-party packages through `npx` without pinning an exact package version or verifying package integrity. If the package is not already available locally, `npx` may retrieve it from the configured package registry and immediately execute it. Consequently, the code that runs can change after this skill has been reviewed. A compromised package release, registry account, dependency, or package-resolution configuration could cause arbitrary attacker-controlled code to run. The external `niracler/skill` component is also not included in this project, so its contents and transitive dependencies were outside the audit scope. The `--fix` command legitimately modifies the supplied article, but a malicious package would not be restricted to that file and could access any resources available to the invoking process. ### Attack Path 1. An attacker compromises a referenced package, one of its dependencies, its publisher account, or the package source selected by the victim's registry configuration. 2. The attacker publishes a malicious version or otherwise causes the unpinned package name to resolve to attacker-controlled content. 3. A user or agent follows the skill instructions and runs `npx markdownlint-cli2`, `npx markdownlint-cli2 --fix article.md`, or the external skill setup command. 4. `npx` downloads the unresolved package and may run installation lifecycle scripts or the package executable. 5. The malicious code exec ...[truncated 817 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every package to an exact reviewed version, for example: ```bash npx --yes markdownlint-cli2@REVIEWED_VERSION article.md npx --yes markdownlint-cli2@REVIEWED_VERSION --fix article.md ``` 2. Prefer declaring the package in a reviewed project manifest and committing the associated lockfile with integrity hashes. Execute the locked local binary rather than resolving the latest package dynamically. 3. Install dependencies in a controlled setup phase using a lockfile-enforcing command such as `npm ci`, then run: ```bash npx --no-install markdownlint-cli2 article.md ``` This prevents `npx` from silently downloading a missing package at invocation time. 4. Review transitive dependencies and use trusted registry configuration. Where operationally practical, disable dependency lifecycle scripts during installation. 5. Replace the dynamically retrieved external skill with a vendored and audited copy, or reference an immutable, verified revision. 6. Require explicit user confirmation before downloading dependencies, executing third-party tools, or applying `--fix`. 7. Run the linting tool in a restricted environment with minimal filesystem permissions, no unnecessary credentials, and limited network access. ]]>