T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:39
- Finding
- Unpinned Packages Installed Globally from npm## Vulnerability Details **File Location**: `SKILL.md`, lines 39–65 **Vulnerability Type**: Unpinned global third-party dependency installation **Risk Level**: Medium The Skill instructs the agent to install mutable npm package versions into the user's global npm environment: ```bash npm install --global sensenova-skills-deepresearch deepresearch --help ``` It also explicitly upgrades the package to the mutable `latest` release: ```bash npm install --global sensenova-skills-deepresearch@latest ``` The optional Claude Code adapter is similarly installed without an exact version: ```bash npm install -g @agentclientprotocol/claude-agent-acp ``` ### Technical Analysis These commands resolve package versions at installation time rather than installing versions whose contents were reviewed and approved with this Skill. The `@latest` tag is explicitly mutable, while an omitted version generally resolves through the registry's current distribution tag. npm installation may execute package lifecycle scripts, including `preinstall`, `install`, and `postinstall`, with the permissions of the account running the agent. Because the packages are installed globally, their executables and supporting files are added to a shared user-level tool location rather than an isolated environment. The Skill does require authorization before installation, which limits silent modification, but user approval does not establish the integrity of whatever package version the registry resolves in the future. The reviewed Skill therefore delegates executable behavior to mutable external dependencies that are outside the audited artifact. ### Attack Path 1. An attacker compromises an npm publisher account, package release process, registry resolution path, or another part of the relevant dependency supply chain. 2. The attacker publishes a malicious version under the expected package name and assigns it to the default or `latest` distributi ...[truncated 1458 chars]
- Remediation
- ## Remediation Suggestions 1. Pin each dependency to an exact reviewed version rather than relying on an omitted version or `@latest`, for example: ```bash npm install --global sensenova-skills-deepresearch@X.Y.Z npm install --global @agentclientprotocol/claude-agent-acp@A.B.C ``` 2. Verify the downloaded package against an approved npm integrity digest or a signed release provenance record before installation. 3. Maintain an allowlist containing approved package names, versions, registry origins, and integrity values. 4. Use a trusted, explicitly configured npm registry and reject unexpected registry overrides. 5. Prefer a project-local or isolated user-scoped installation over a global installation, then invoke the binary using an explicit verified path. 6. Where package compatibility permits, install with lifecycle scripts disabled and separately execute only reviewed setup steps: ```bash npm install --ignore-scripts --save-exact package-name@X.Y.Z ``` 7. If lifecycle scripts are required, inspect the exact package tarball and its dependency tree before authorization and execution. 8. Treat upgrades as separate security-sensitive operations: display the current and proposed exact versions, summarize provenance, and obtain approval for that specific version. 9. Periodically audit and rotate approved versions rather than automatically tracking a mutable distribution tag.