T08 · Insecure Dependencies
Warning
- Location
SKILL.md:398- Finding
Execution of an unaudited third-party fallback dependency
- Content
View full analysis
` and first try this Skill: `scripts/run.js draft `. 2. If the task returns `failed` and the error contains retrieval failure, 403, forbidden, login required, or empty content, switch to `news-to-markdown-skill`: ```bash node /news-to-markdown-skill/scripts/run.js convert \ --url "" \ --download-images \ --output-dir ./drafts/ ``` ``` The associated installation instruction is: ```bash npm install --ignore-scripts --save-exact news-to-markdown@3.3.1 ``` ### Technical Analysis The Skill directs the Agent or user to install an external npm package, clone or otherwise obtain a separate repository, and execute that repository's `scripts/run.js`. This third-party code is outside the audited project. Pinning the npm package to version `3.3.1` and disabling npm lifecycle scripts are useful mitigations, but they do not establish the integrity of: - The package contents served by the registry. - Transitive dependencies installed with the package. - The separately obtained Git repository. - The relationship between the npm package and the executed repository. - Future replacement or compromise of the local checkout path. The documentation itself acknowledges that the fixed version does not mean the dependency h ...[truncated 1668 chars]- Remediation
View remediation