T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:83
- Finding
- Unpinned Third-Party Security Tools May Retrieve and Execute Mutable Registry Code<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 83, 94–97, 104, 122, and 204 **Vulnerability Type**: Supply-chain risk from unpinned package installation and execution **Risk Level**: Medium ### Vulnerable Code ```bash # SKILL.md:83 echo "Install pip-audit: pip install pip-audit" ``` ```bash # SKILL.md:94-97 cargo audit 2>/dev/null || echo "Install: cargo install cargo-audit" # Outdated cargo outdated 2>/dev/null || echo "Install: cargo install cargo-outdated" ``` ```bash # SKILL.md:104 govulncheck ./... 2>/dev/null || echo "Install: go install golang.org/x/vuln/cmd/govulncheck@latest" ``` ```bash # SKILL.md:122 bundle audit check --update 2>/dev/null || echo "Install: gem install bundler-audit" ``` ```bash # SKILL.md:204 npx npm-check-updates -u --target minor && npm install ``` ### Technical Analysis The skill recommends installing third-party tools without pinning them to exact, reviewed versions. In particular, `@latest` explicitly selects mutable registry content, while unversioned `pip install`, `cargo install`, and `gem install` commands resolve whatever release the relevant registry currently serves. The `npx npm-check-updates` command presents the highest direct exposure because `npx` may download and execute the currently resolved package when it is not already installed locally. The command then rewrites dependency declarations with `-u` and invokes `npm install`, which can execute package lifecycle scripts from the newly resolved dependency graph. These commands therefore establish a supply-chain execution path in which the effective code may change after the skill has been reviewed. Although the installation commands for several ecosystems are displayed as recommendations rather than automatically run by the shown shell expressions, a user or agent following those recommendations would still be exposed to mutable third-party packages. ### Attack Path 1. A user invokes the dependency-audit or upgrade workflow. 2. ...[truncated 1664 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every recommended tool to an exact, reviewed version: - Use `pip install pip-audit==<reviewed-version>`. - Use `cargo install cargo-audit --version <reviewed-version> --locked`. - Use `cargo install cargo-outdated --version <reviewed-version> --locked`. - Replace Go's `@latest` with `@<reviewed-version>`. - Use `gem install bundler-audit -v <reviewed-version>`. - Replace `npx npm-check-updates` with `npx --no-install npm-check-updates` when a trusted local installation is required, or specify an exact reviewed package version. 2. Verify package integrity using ecosystem-supported hashes, checksums, signatures, lockfiles, or an approved internal registry mirror. 3. Separate audit reporting from project mutation. Do not automatically rewrite manifests or run `npm install` during a read-only audit. 4. Display the proposed command and exact dependency changes before execution, and require explicit user approval before: - Downloading a new tool - Executing registry-sourced code - Changing manifests or lockfiles - Running package lifecycle scripts 5. Run dependency tools with least privilege in an isolated container or sandbox that has no unnecessary credentials and only limited write access to the project. 6. For npm installation, consider disabling lifecycle scripts during initial inspection with `--ignore-scripts`, then review required scripts before permitting them. 7. Correct the documentation's claim that the workflow operates “entirely locally.” Audit and update commands can contact external package registries and retrieve mutable metadata or executable packages. ]]>