T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:17
- Finding
- Unpinned Third-Party Package Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:17`, `SKILL.md:94-95`, `_meta.json:8-10`, and `scripts/vigil-check.js:29` **Vulnerability Type**: Unpinned and unaudited third-party dependency execution **Risk Level**: Medium ### Vulnerable Code `SKILL.md:17`: ```bash npm install vigil-agent-safety ``` `SKILL.md:94-95`: ```bash npx vigil-agent-safety check --tool exec --params '{"command":"ls -la"}' npx vigil-agent-safety policies ``` `_meta.json:8-10`: ```json "requires": { "npm": ["vigil-agent-safety"] } ``` `scripts/vigil-check.js:29`: ```javascript const { checkAction } = await import('vigil-agent-safety'); ``` ### Technical Analysis The Skill instructs users to install and execute `vigil-agent-safety` without specifying an exact package version or an integrity digest. The project also contains no lockfile or vendored dependency source from which the executed implementation could be verified. The `npx vigil-agent-safety` instructions are particularly sensitive because `npx` can download and immediately execute a package from the npm registry when a suitable local copy is unavailable. Consequently, the code that ultimately runs can differ from the implementation reviewed when this Skill was published. The wrapper imports the dependency and passes complete tool-call parameters to it: ```javascript const result = checkAction({ tool, params }); ``` Those parameters may contain shell commands, filesystem paths, URLs, API arguments, or credentials. A compromised or unexpectedly modified dependency could inspect or exfiltrate this information and perform arbitrary actions available to the Node.js process. The dependency implementation is absent from the audited project. Therefore, its advertised rule behavior, lack of side effects, and claimed zero-dependency design cannot be independently established from the supplied files. ### Attack Path 1. An attacker compromises the npm publisher account, registry package, release pipeline ...[truncated 1760 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a reviewed exact version rather than using an unconstrained package name: ```bash npm install --save-exact vigil-agent-safety@<reviewed-version> ``` 2. Commit a `package.json` and `package-lock.json` containing the exact resolved version and npm integrity hash. 3. Replace implicit `npx` retrieval with execution of the pinned local binary: ```bash npm exec --offline -- vigil-agent-safety check --tool exec --params '{"command":"ls -la"}' ``` Alternatively, invoke `./node_modules/.bin/vigil-agent-safety` after a verified installation. 4. Audit or vendor the source code corresponding to the pinned package release so that the implementation included in the security boundary can be reviewed. 5. Install dependencies with lifecycle scripts disabled where compatible: ```bash npm ci --ignore-scripts ``` 6. Run the checker in a restricted environment with: - No unnecessary write access. - No access to SSH keys, cloud credentials, or unrelated secrets. - Denied outbound network access unless explicitly required. - A minimal environment-variable allowlist. - Child-process restrictions where supported. 7. Avoid passing secrets in tool parameters when they are not necessary for policy evaluation. Redact tokens, credentials, and sensitive request data before calling `checkAction`. 8. Add automated dependency review, integrity verification, and vulnerability monitoring for the pinned release. ]]>