T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:17
- Finding
- Unpinned Third-Party CLI Installation Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md:17-21`; `references/setup.md:36-53` **Vulnerability Type**: Unpinned and mutable third-party dependencies **Risk Level**: Medium The Skill installs and executes the third-party `yutu` CLI without pinning an audited version, immutable commit, checksum, or cryptographic signature. ### Vulnerable Code `SKILL.md:17-21`: ```yaml install: - kind: node package: "@eat-pray-ai/yutu" bins: [yutu] ``` `references/setup.md:36-53`: ```bash # Node.js (all platforms) npm i -g @eat-pray-ai/yutu # macOS brew install yutu # Linux brew install yutu # Windows winget install yutu # Gopher go install github.com/eat-pray-ai/yutu@latest ``` ```markdown ### Other platforms Download a prebuilt binary from the [releases page](https://github.com/eat-pray-ai/yutu/releases/latest) and place it in your PATH. ``` ### Technical Analysis The npm package declaration and installation command omit an exact version. The Go installation explicitly uses the mutable `@latest` reference, while the binary download points to a mutable latest-release URL. Package-manager installations likewise do not identify an audited release. Consequently, the artifact installed when a user follows these instructions can differ from the artifact that existed when the Skill was audited. If the package registry account, source repository, release pipeline, package-manager formula, or publisher credentials are compromised, an attacker could distribute a modified executable under the expected package name. A global npm installation may also run package lifecycle scripts with the installing user's privileges. This finding does not establish that the current `yutu` package is malicious. It identifies the absence of controls that bind installation to a reviewed artifact. ### Attack Path 1. An attacker compromises an upstream publisher account, package registry entry, source rep ...[truncated 1560 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the npm dependency to a specific audited version, such as `@eat-pray-ai/yutu@X.Y.Z`, rather than allowing implicit latest-version resolution. 2. Replace `go install github.com/eat-pray-ai/yutu@latest` with an exact release tag or, preferably, an immutable commit. 3. Replace the mutable `/releases/latest` download with a version-specific release URL. 4. Publish SHA-256 checksums for supported binaries and document checksum verification before execution. 5. Verify signed release tags, package provenance, or cryptographic artifact signatures where supported. 6. Lock package-manager installation instructions to reviewed versions when the relevant manager supports version pinning. 7. Review npm lifecycle scripts and use `--ignore-scripts` where compatible with installation requirements. 8. Perform installation and initial validation with a non-privileged account in an isolated environment. 9. Restrict OAuth scopes to the minimum required for listing membership levels and protect token files with owner-only filesystem permissions. 10. Maintain a documented update process in which each new dependency version is reviewed, checksummed, and explicitly approved before the pin is changed.