T08 · Insecure Dependencies
Error
- Location
- SKILL.md:95
- Finding
- Unpinned Third-Party Packages Are Installed and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:95-97` **Related Locations**: `SKILL.md:136-140, 283-304, 406`; `references/cli.md:9-16, 46-49, 59-62, 82-119`; `references/stripe-method.md:164-176` **Vulnerability Type**: Unpinned dependency installation and immediate package execution **Risk Level**: High ### Vulnerable Code ```markdown Install: `npm install mppx viem` (mppx 0.8.15 requires `viem >= 2.54.0`). Validate the finished server end-to-end with `npx mppx validate http://localhost:3000`. ``` Additional affected examples include: ```bash pip install "pympp[tempo]" cargo add mpp --features tempo,server npx @stripe/link-cli spend-request create npx skills add tempoxyz/mpp -g ``` ### Technical Analysis The Skill recommends installing dependencies without exact version constraints and repeatedly uses `npx` to download and immediately execute packages. Although the metadata identifies versions against which the documentation was checked, those versions are not consistently enforced in the executable commands. An unqualified `npx mppx` or `npx @stripe/link-cli` invocation can resolve a mutable package version from the configured npm registry. The reviewed Skill therefore does not fully determine the code that will execute when a user follows its instructions. A compromised package publisher, registry account, transitive dependency, or malicious future release could alter the effective payload after this Skill has been audited. The affected commands may run in an environment containing wallet mnemonics, local account keys, system keychain access, Stripe credentials, API tokens, MCP configuration, and funded payment accounts. The global Skill synchronization command additionally imports mutable remote instructions into agent environments. ### Attack Path 1. An attacker compromises a referenced package publisher, registry account, or dependency. 2. The attacker publishes a malicious package version under the expected package name. 3. ...[truncated 1158 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every dependency to an exact reviewed version, for example: ```bash npm install --save-exact mppx@0.8.15 viem@2.54.0 npx --package=mppx@0.8.15 mppx validate http://localhost:3000 ``` 2. Prefer a committed lockfile with integrity metadata and use reproducible installation commands such as `npm ci`. 3. Install command-line packages locally and execute the locked local binary rather than allowing `npx` to resolve the latest registry version. 4. Use `npm exec --offline` or an equivalent offline mechanism after dependencies have been reviewed and installed. 5. Pin Python and Rust dependencies in lockfiles or requirements files with hashes. 6. Review package provenance, signatures, publisher identity, and transitive dependencies before installation. 7. Do not install remote Skill content globally without displaying and reviewing the exact revision. 8. Run package installation and validation in a sandbox without production secrets, funded wallets, or broad filesystem access. ]]>