T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:6
- Finding
- Unpinned Third-Party Package Is Downloaded and Executed Through npx## Vulnerability Details **File Location**: `SKILL.md`, lines 6–7 and 40–43 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```yaml dependencies: - "@springmint/x402-payment" ``` ```bash npx @springmint/x402-payment \ --url https://www.cpbox.io/api/x402/batch-balance \ --method POST \ --input '{"chain":"ethereum","token":"","addresses":["0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045","0xBE0eB53F46cd790Cd13851d5EFf43D12404d33E8"]}' ``` ### Technical Analysis The Skill instructs users or an AI Agent to execute `@springmint/x402-payment` through `npx` without specifying an exact package version. If the package is not already installed locally, `npx` may retrieve executable package content from the npm registry at invocation time. Consequently, the code that executes can differ from the code originally reviewed. This package occupies a sensitive trust position because the documented workflow uses it to configure a wallet, create EIP-712 payment signatures, communicate with external services, and perform automatic payments. The audited project does not contain the dependency source, a lockfile, a cryptographic integrity value, or other controls that bind execution to a reviewed artifact. The external API communication itself is consistent with the Skill's declared batch-balance functionality: wallet addresses are sent to the API provider, and a payment signature is sent to authorize payment. The document does not instruct users to transmit a private key. The vulnerability is therefore the uncontrolled dependency execution path rather than the necessary API request. ### Attack Path 1. An attacker compromises the npm account, publication process, or distribution infrastructure associated with `@springmint/x402-payment`. 2. The attacker publishes a malicious package version that is selected when the unversioned `npx` command resolves the dependency. 3. A user or AI ...[truncated 1602 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency and command to an exact, reviewed version, for example `@springmint/x402-payment@X.Y.Z`, rather than allowing registry-time version resolution. 2. Provide a lockfile with verified integrity metadata and require installation through a reproducible package-manager workflow. 3. Avoid ad hoc `npx` retrieval during Skill execution. Install the approved dependency in a controlled build or provisioning stage and invoke the locally installed binary. 4. Verify package provenance through registry signatures, checksums, or an internally controlled package mirror. 5. Review the dependency and its transitive dependencies before approval, especially wallet loading, signing, payment-validation, and network-request logic. 6. Run the client in a sandbox with access only to files and network destinations required for this API. 7. Use a dedicated low-value wallet with explicit spending, token, chain, recipient, and per-transaction limits. 8. Require confirmation of the payment asset, amount, destination, chain, and domain before signing rather than relying on unrestricted automatic payment. 9. Ensure private keys are held by a constrained signer or hardware-backed wallet and are never exposed directly to general-purpose dependency code where avoidable. 10. Add the missing prerequisite and secret-handling documentation to the auditable project so wallet setup and credential protections can be reviewed.