T08 · Insecure Dependencies
Warning
- Location
SKILL.md:230- Finding
Unpinned Third-Party Dependencies and Globally Installed CLI Tools
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:18,SKILL.md:230-232,SKILL.md:265-269, andSKILL.md:451-478
Vulnerability Type: Unpinned and insufficiently verified third-party dependencies
Risk Level: MediumVulnerable Code
SKILL.md:18:markdown - **node-canvas** (`npm install canvas`) — used for adding text overlays to slide images. This is a native module that may need build tools (Python, make, C++ compiler) on some systems. Your agent should research the install requirements for your OS.SKILL.md:230-232:bash npm i -g @posteahora/cli posteahora auth --key pah_live_... posteahora accountsSKILL.md:265-269:markdown 1. **Install the RevenueCat skill from ClaWHub:** ``` clawhub install revenuecat ``` This installs the `revenuecat` skill (v1.0.2+) which gives full API access to your RevenueCat project — metrics overview, customers, subscriptions, offerings, entitlements, transactions, and more. It includes reference docs for every API endpoint and a helper script (`scripts/rc-api.sh`) for direct API calls.SKILL.md:451-478:markdown Before you can add text overlays, your human needs to install `node-canvas`. Prompt them: > ```bash > npm install canvas > ``` > > **macOS:** > ```bash > brew install pkg-config cairo pango libpng jpeg giflib librsvg > npm install canvas > ``` > > **Ubuntu/Debian:** > ```bash > sudo apt-get install build-essential libcairo2-dev libpango1.0-dev libjpeg-dev libgif-dev librsvg2-dev > npm install canvas > ``` > > **Windows:** > ```bash > # node-canvas auto-downloads prebuilt binaries on Windows > npm install canvas > ```Technical Analysis
The Skill instructs users or agents to install mutable third-party packages without exact version pins, lockfiles, integrity hashes, or evidence that the selected artifacts have been reviewed. The
v1.0.2+requirem ...[truncated 2433 chars]- Remediation
View remediation
Remediation Suggestions
- Pin every dependency and Skill to an exact reviewed version rather than a floating latest version or minimum-version range.
- Provide a committed lockfile and use deterministic installation commands such as
npm ci. - Verify registry provenance, package ownership, release signatures, and integrity hashes before installation.
- Review package lifecycle scripts and disable them with
--ignore-scriptswhere installation does not require them. - Install the PosteAhora CLI locally in an isolated project instead of globally, and invoke it through a version-pinned package runner.
- Use a container, virtual machine, or restricted build environment for native dependency compilation.
- Require explicit user approval before installing dependencies or operating-system packages.
- Never run NPM or ClaWHub installations as root. Keep privileged operating-system package installation separate from unprivileged application dependency installation.
- Pin transitive dependencies through the lockfile and use automated vulnerability, provenance, and license scanning.
- Replace
v1.0.2+with a specific audited RevenueCat Skill version and re-audit before upgrading.