T08 · Insecure Dependencies
Error
- Location
- SKILL.md:18
- Finding
- Unpinned npm Package Is Downloaded and Executed for Financial Operations<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 18–23 and 65–89 **Vulnerability Type**: Unpinned remote dependency execution **Risk Level**: High ### Complete Code Snippet ```markdown ## CLI entry point All commands in this skill use `npx -y aiusd-core` as the CLI prefix. This works without any global installation — npx resolves the package from npm automatically. If `aiusd-core` is already in PATH (via `npm install -g aiusd-core`), you may use `aiusd-core` directly instead. **NEVER use `dist/cli.js` — it is a library module, not an entry point.** ``` The same remotely resolved package is also trusted to provide mutable operating instructions: ```markdown ## Capabilities Before executing commands in a domain, run `npx -y aiusd-core guide <domain>` to get the latest commands, parameters, and workflows. Follow the guide exactly. ``` The Skill further directs the Agent to act on instructions returned by that package: ```markdown ### Always guide before operate Do not guess command syntax or parameters from memory. Before executing commands in any domain, run `npx -y aiusd-core guide <domain>` to get the current reference. Guides may change between CLI versions. ### Asset names can be ambiguous The same asset symbol may exist on multiple venues. When the user's intent is ambiguous, ask which venue before executing. If the user has a clear preference from context (e.g., "buy SOL" implies Solana), proceed without asking. ### Follow `next_steps`, don't re-confirm When a command returns `action_required` with `next_steps`, execute those steps directly. The user has already confirmed the intent — do not ask again unless the next step involves a different action than what was originally requested. ``` ### Technical Analysis The command `npx -y aiusd-core` resolves and executes the npm package without specifying an exact version. The project contains no lockfile, package integrity hash, vendored executable source, or other mechanis ...[truncated 3342 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Pin an exact reviewed version** - Replace unversioned execution with an exact immutable version, such as `npx --yes aiusd-core@1.0.1`, after independently reviewing that release. - Do not use version ranges or distribution tags such as `latest`. 2. **Verify package integrity** - Maintain a lockfile containing the expected resolved version and integrity hash. - Verify the downloaded package checksum or npm integrity metadata before execution. - Fail closed if the version or integrity value differs from the approved value. 3. **Vendor and review security-sensitive code** - Prefer bundling a reviewed copy of the executable source with the Skill. - Make the reviewed local entry point the default rather than downloading executable code during each invocation. - Subject every dependency update to source review, malware scanning, and reproducible-build verification. 4. **Reduce installation-time execution risk** - Disable npm lifecycle scripts where compatible, for example through an audited installation process using `--ignore-scripts`. - Install dependencies in a controlled build stage rather than dynamically during financial operations. 5. **Sandbox the CLI** - Execute it as a dedicated, unprivileged operating-system identity. - Restrict filesystem access to the minimum required configuration directory. - Limit environment variables and prevent access to unrelated credentials. - Apply outbound network restrictions so the process can contact only explicitly approved endpoints. 6. **Constrain remote instructions** - Treat `guide` and `next_steps` output as untrusted data. - Validate generated commands against a local allowlist of approved commands, options, networks, and parameter types. - Reject shell metacharacters, unexpected executables, arbitrary file access, and instructions outside the requested domain. 7. **Require confirmation at financial boundaries** - Require ...[truncated 705 chars]