T08 · Insecure Dependencies
Error
- Location
- SKILL.md:155
- Finding
- Unpinned npm Packages May Be Downloaded and Executed Through npx<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:155-158` and `SKILL.md:513` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: High ### Vulnerable Code ```bash if command -v npx &>/dev/null; then echo "" echo "Running Tailwind dry-run to check purged classes..." npx --yes tailwindcss -i ./input.css -o /tmp/tw-output.css --minify 2>/dev/null echo "Output size: $(du -h /tmp/tw-output.css 2>/dev/null | cut -f1)" fi ``` A second unpinned invocation appears in the suggested cleanup workflow: ```bash # 4. After cleanup, verify no regressions # Run your visual regression tests, or: npx percy snapshot --dry-run # if using Percy ``` ### Technical Analysis The skill invokes npm packages by package name without an exact version, lockfile-backed resolution, or integrity verification. If the requested package is not installed locally, `npx` can retrieve it from a configured npm registry and execute its CLI entry point. The `--yes` option on the Tailwind invocation suppresses the normal installation confirmation. Consequently, the effective executable code is mutable after the skill has been reviewed. A compromised package release, maintainer account, transitive dependency, registry, or npm configuration could cause attacker-controlled JavaScript to execute. Package lifecycle behavior and CLI startup code run with the same operating-system identity and environment available to the agent. Although the skill advertises zero external APIs, these commands can still create outbound registry traffic and retrieve executable third-party content. ### Attack Path 1. A user invokes the CSS dead-code skill in a project where `npx` is available. 2. The Tailwind analysis branch reaches `npx --yes tailwindcss`, or the user follows the suggested `npx percy` verification command. 3. The requested package is absent locally, or npm resolves a mutable version using registry and project configuration. 4. `npx` downloads the packa ...[truncated 1401 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not allow the skill to download packages implicitly. Require dependencies to be installed and reviewed before invocation. 2. Execute only the project-local binary and fail safely when it is absent: ```bash TAILWIND_BIN="./node_modules/.bin/tailwindcss" if [ -x "$TAILWIND_BIN" ]; then "$TAILWIND_BIN" -i ./input.css -o /tmp/tw-output.css --minify else echo "Tailwind CLI is not installed locally; skipping CLI analysis." fi ``` 3. Pin exact dependency versions in `package.json` and commit a lockfile with integrity metadata. Install dependencies through a controlled CI or setup phase using a command such as `npm ci`, rather than during the audit. 4. Replace `npx percy` with an explicitly installed, lockfile-pinned local binary such as `./node_modules/.bin/percy`. 5. If on-demand retrieval is unavoidable, require explicit user approval, specify an exact reviewed version, use a trusted registry, and enforce lockfile or integrity verification. 6. Run third-party tooling in a sandbox with minimal filesystem access, a sanitized environment, no sensitive credentials, and restricted outbound network access. 7. Update the documentation to disclose that `npx` may access an external package registry and execute downloaded code. ]]>