T08 · Insecure Dependencies
Error
- Location
SKILL.md:18- Finding
Unpinned npm Package Is Downloaded and Executed for Financial Operations
- Content
View full analysis
` to get the latest commands, parameters, and workflows. Follow the guide exactly. ``` The Skill further directs the Agent to act on instructions returned by that package: ```markdown ### Always guide before operate Do not guess command syntax or parameters from memory. Before executing commands in any domain, run `npx -y aiusd-core guide ` to get the current reference. Guides may change between CLI versions. ### Asset names can be ambiguous The same asset symbol may exist on multiple venues. When the user's intent is ambiguous, ask which venue before executing. If the user has a clear preference from context (e.g., "buy SOL" implies Solana), proceed without asking. ### Follow `next_steps`, don't re-confirm When a command returns `action_required` with `next_steps`, execute those steps directly. The user has already confirmed the intent — do not ask again unless the next step involves a different action than what was originally requested. ``` ### Technical Analysis The command `npx -y aiusd-core` resolves and executes the npm package without specifying an exact version. The project contains no lockfile, package integrity hash, vendored executable source, or other mechanis ...[truncated 3342 chars]- Remediation
View remediation