T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:32
- Finding
- Unpinned Runtime Package Is Downloaded and Executed on Every Invocation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:32-34` **Vulnerability Type**: Supply-chain risk from unpinned remote package execution **Risk Level**: Medium ### Vulnerable Code ```markdown The skill is invoked via: ```bash npx -y bun ${SKILL_DIR}/scripts/cli.ts [command] [subcommand] [args] [options] ``` ``` The same unpinned `npx -y bun` invocation is repeated in the usage examples at `SKILL.md:40-72`. ### Technical Analysis The documented execution mechanism instructs users or agents to run the npm package named `bun` through `npx` without specifying an exact version or enforcing package integrity. The `-y` option suppresses the installation confirmation. Consequently, the code executed before the local CLI starts is determined dynamically by the package registry at invocation time. The project contains no lockfile or integrity metadata that constrains this downloaded runtime package to the version reviewed during the audit. This behavior creates a supply-chain trust boundary: compromise of the relevant package, registry account, package distribution infrastructure, or dependency resolution path could cause arbitrary third-party code to run. That code would execute in the same process environment in which the Skill expects `ROBLOX_API_KEY` to be available. This is distinct from the Skill's intentional Roblox API traffic. The API client sends the key only in an `x-api-key` header to fixed HTTPS endpoints under `apis.roblox.com`, which is necessary for the declared functionality. The tests replace `globalThis.fetch` with mocks and use non-production fixture keys. ### Attack Path 1. An attacker compromises or maliciously modifies the npm package resolved by `npx -y bun`, its publishing account, or the applicable package-resolution infrastructure. 2. A user or agent follows the documented command while `ROBLOX_API_KEY` is set. 3. `npx` downloads the currently resolved package without interactive confirmation and without an exact revie ...[truncated 1122 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not download a runtime package dynamically for each Skill invocation. Prefer a separately installed, trusted Bun executable: ```bash bun ${SKILL_DIR}/scripts/cli.ts [command] [subcommand] [args] [options] ``` 2. Declare the required Bun version in installation documentation and verify it before execution: ```bash bun --version ``` 3. If npm-based acquisition is unavoidable, pin an exact reviewed version rather than using an unconstrained package: ```bash npx -y bun@<exact-reviewed-version> ${SKILL_DIR}/scripts/cli.ts [command] [subcommand] [args] [options] ``` 4. Commit and enforce a lockfile with integrity hashes where the selected package manager supports it. Installation should use immutable or frozen-lockfile mode. 5. Install and verify the runtime before exposing `ROBLOX_API_KEY` to the process. Avoid placing sensitive credentials in the environment of package-installation steps. 6. Restrict the Roblox API key to only the required permissions and experiences. Use separate read-only and write-capable keys where operationally possible, and rotate the key if supply-chain compromise is suspected. 7. Update all command examples at `SKILL.md:40-72` so they no longer encourage repeated unpinned package retrieval. ]]>