T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:14
- Finding
- Unpinned Third-Party npm Package Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 14–23 and 54 **Vulnerability Type**: Unpinned external npm dependency executed through `npx` **Risk Level**: Medium ### Vulnerable Code ```bash # Diff two specs (breaking vs non-breaking) npx @sethclawd/schemaguard diff old.yaml new.yaml # CI check (exit 0=safe, 1=breaking, 2=error) npx @sethclawd/schemaguard ci --spec ./openapi.yaml --baseline ./baseline.yaml # Lint spec quality npx @sethclawd/schemaguard lint ./openapi.yaml # JSON output for programmatic use npx @sethclawd/schemaguard diff old.yaml new.yaml --format json ``` ```bash npx @sethclawd/schemaguard --mcp ``` ### Technical Analysis The Skill directs users and agents to execute `@sethclawd/schemaguard` without specifying an exact package version. If the package is not already installed, `npx` may retrieve it from the configured npm registry and execute its lifecycle or runtime code. The project contains no package manifest, lockfile, integrity hash, vendored implementation, source revision, or other mechanism that binds execution to the version reviewed during the audit. The effective executable payload can therefore change after the Skill has been reviewed. Package-owner compromise, registry compromise, or a subsequently malicious release could introduce arbitrary code into this execution path. The package implementation was not included in the audited project, so its actual runtime behavior could not be statically verified. This finding identifies an unsafe supply-chain boundary; it does not assert that the current external package is malicious. ### Attack Path 1. An attacker compromises the npm publisher account, release process, or another part of the package supply chain. 2. The attacker publishes a malicious version under the same package name. 3. A user or agent follows `SKILL.md` and runs one of the unversioned `npx @sethclawd/schemaguard ...` commands. 4. `npx` resolves and downloads the attacker-controlled release fro ...[truncated 1027 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to an audited exact version rather than allowing dynamic resolution, for example: ```bash npx --yes @sethclawd/schemaguard@1.2.3 diff old.yaml new.yaml ``` 2. Add a package manifest and lockfile containing npm integrity metadata, install dependencies through a controlled process, and invoke the local binary with: ```bash npx --no-install schemaguard diff old.yaml new.yaml ``` 3. Verify the selected release against its authoritative source repository, publisher identity, provenance attestations, and expected integrity digest before approving it. 4. Configure CI to use a trusted registry, enforce lockfile integrity, disable unexpected lifecycle scripts where compatible, and prevent automatic dependency updates without review. 5. Run the package with least privilege in an isolated environment. Limit filesystem access, network access, environment variables, and credentials to those required for schema analysis. 6. Apply the same pinning and isolation controls to MCP server mode. Review the package implementation and exposed MCP tools before allowing an agent to invoke them. 7. Prefer vendoring or otherwise including reviewable implementation code when practical, especially when the Skill is intended for automated execution in sensitive environments.