T08 · Insecure Dependencies
Error
- Location
SKILL.md:4- Finding
Unpinned npm Package Is Automatically Downloaded and Executed
- Content
View full analysis
` means: ```bash npx --yes polyv-live-cli@latest ``` Before executing a command, `` must be expanded to the real command above; do not execute the literal placeholder ``. If the npm latest help conflicts with a reference, the npm latest ` ... --help` output takes precedence. ``` From `references/command-index.md`: ```markdown This file is generated from the published CLI help and is used to locate command paths quickly. The corresponding `--help` must still be run before execution to validate parameters. CLI prefix: `` = `npx --yes polyv-live-cli@latest` ``` ### Technical Analysis The Skill mandates execution of `polyv-live-cli` through the mutable npm `latest` tag. The `npx --yes` combination can download and execute package code automatically without an interactive approval step. No exact version, lockfile, package integrity value, or reviewed local copy constrains the code that will execute. The effective implementation can therefore change after this Skill has been audited. The instruction that live npm output takes precedence over bundled references further makes the remotely published package authoritative over the reviewed project content. This CLI is expected to receive PolyV application credentials and exercise extensive livestream-management capabilities. Consequently, compromise of the npm package, its publisher account, the configured re ...[truncated 2083 chars]- Remediation
View remediation