T08 · Insecure Dependencies
Error
- Location
- SKILL.md:87
- Finding
- Unpinned Third-Party Package Download and Execution via npx## Vulnerability Details **File Location**: `SKILL.md`, lines 87–97 **Vulnerability Type**: Unpinned and unaudited dependency execution **Risk Level**: High **Vulnerable code:** ```markdown If the user has a GitHub profile, offer to pre-fill from it using: `npx create-me-txt --github username` ## Fetching a me.txt To look up someone's me.txt, try these URLs in order: 1. `https://domain.com/me.txt` 2. `https://domain.com/.well-known/me.txt` 3. `https://metxt.org/api/lookup?domain=domain.com` (directory fallback) Or use the CLI: `npx create-me-txt` then run `me-txt fetch domain.com` ``` ### Technical Analysis The Skill recommends executing `create-me-txt` through `npx` without specifying an exact package version, integrity value, or verified source. If the package is not already installed locally, `npx` may retrieve the current package release from the configured npm registry and immediately execute it. Consequently, the code executed is mutable after the Skill has been reviewed. Compromise of the package, maintainer account, registry publication process, or dependency chain could cause arbitrary third-party code to execute in the user's environment. The package receives at least a GitHub username in the pre-fill workflow and may inherit the process environment and the user's filesystem permissions. This execution exceeds minimum privilege because the Skill already documents procedures for manually creating and fetching a `me.txt` file. Running an external package is therefore optional rather than essential to the declared functionality. The documented directory fallback at `https://metxt.org/api/lookup?domain=domain.com` performs expected network access for the lookup feature. It discloses the requested domain and requester network metadata to the service, but the reviewed text does not direct transmission of credentials, environment variables, or private local files. ### Attack Path 1. An attacker compromises ...[truncated 1155 chars]
- Remediation
- ## Remediation Suggestions 1. Prefer the documented manual creation, direct HTTPS retrieval, and local structural validation procedures instead of executing an npm package. 2. If the CLI remains necessary, pin it to an exact reviewed version rather than allowing `npx` to resolve the latest release. 3. Verify package ownership, provenance, release signatures where available, and package integrity before use. 4. Review the package and its transitive dependency tree before approving execution. 5. Install dependencies through a committed lockfile and use integrity-enforcing installation workflows. 6. Disable lifecycle scripts where compatible with the package and avoid implicit installation through `npx`. 7. Run the CLI in a restricted sandbox or container with no unnecessary credentials, minimal filesystem mounts, and limited outbound network access. 8. Require explicit user confirmation before downloading or executing third-party code and clearly disclose the package source and version. 9. Require confirmation before external lookups and avoid submitting private or internal domain names to the directory fallback.