T08 · Insecure Dependencies
Warning
- Location
- manifest.json:14
- Finding
- Unpinned Executable npm Dependencies Create a Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `manifest.json:14-20` **Vulnerability Type**: Unpinned third-party executable dependencies **Risk Level**: Medium ### Vulnerable Code ```json "install": { "npm": ["acpx"], "optional": { "acp-agents": ["opencode-ai", "@anthropic-ai/pi"], "cli-agents": ["kimi-cli", "kilocode"] } }, ``` ### Technical Analysis The manifest specifies executable npm packages without exact versions, lockfile references, or integrity hashes. Package resolution can therefore select mutable future releases rather than a version reviewed with this project. The project contains documentation and configuration but does not include the implementation of the advertised orchestrator. Its core behavior is delegated to the external `acpx` package and optional agent packages. Consequently, reviewing this repository alone cannot establish what code will execute during package installation or at runtime. If one of these packages or its transitive dependencies is compromised, a malicious release could execute through npm lifecycle scripts or when the installed CLI is invoked. This is a supply-chain weakness rather than evidence that the currently published packages are malicious. ### Attack Path 1. An attacker compromises a referenced npm package, its maintainer account, or one of its transitive dependencies. 2. The attacker publishes a malicious release under the legitimate package name. 3. A user installs the Skill dependencies without an exact version or verified lockfile. 4. npm resolves the dependency to the compromised release. 5. Malicious code executes through an installation lifecycle script or when the orchestrator or agent CLI is run. 6. The code operates with the privileges and environmental access of the installing user, including any credentials, source files, or agent capabilities available to that process. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the privile ...[truncated 559 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every direct dependency to an exact, reviewed version rather than relying on the latest registry release. 2. Commit and enforce a package lockfile containing resolved transitive versions and integrity hashes. 3. Verify package provenance, publisher identity, signatures, and registry source before installation. 4. Use `npm ci` or an equivalent reproducible installation mechanism that rejects lockfile drift. 5. Disable npm lifecycle scripts where they are unnecessary, for example with `--ignore-scripts`, and explicitly review packages that require them. 6. Run installation and agent execution in a sandbox or container with minimal filesystem, network, credential, and repository access. 7. Apply automated dependency monitoring while requiring manual security review before accepting version updates. 8. Include or vendor the orchestrator implementation where practical so its effective behavior can be audited together with the Skill. ]]>