T08 · Insecure Dependencies
- Location
SKILL.md:146- Finding
Unpinned Third-Party Dependencies Are Downloaded and Executed at Runtime
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:146,SKILL.md:156-170, andSKILL.md:241
Vulnerability Type: Unpinned and integrity-unverified third-party dependencies
Risk Level: MediumVulnerable Code
bash pip install requestspython result = subprocess.run([ "npx", "figma-developer-mcp", "--file-key", "abc123", "--node-id", "1:2", "--action", "screenshot" ], capture_output=True, text=True)python result = subprocess.run([ "npx", "figma-developer-mcp", "--file-key", "abc123", "--action", "variables" ], capture_output=True, text=True)text figma-developer-mcp | npm package | required | npx figma-developer-mcpTechnical Analysis
The Skill instructs the Agent to install
requestswithout an exact version and to invokefigma-developer-mcpthroughnpxwithout a pinned version, lockfile, checksum, signature, or other integrity control.In particular,
npxmay download a package from the npm registry and execute its package lifecycle or entry-point code immediately. The effective executable payload can therefore change after the Skill has been reviewed. An upstream account compromise, malicious package release, registry compromise, or unexpected package ownership change could cause attacker-controlled code to run when the documented workflow is invoked.The Python dependency is also mutable because no version constraint or hash is supplied. Although there is no evidence that either named package is currently malicious, the installation and execution model exposes users to avoidable software supply-chain risk.
Attack Path
- An attacker compromises the publication account, release pipeline, or distribution channel of one of the referenced packages.
- The attacker publishes a malicious package version under the expected package name.
- A user or Agent follows the Skill instructions without specifying ...[truncated 1265 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin every dependency to an exact, reviewed version, for example by using an explicit npm package version and an exact Python package version.
- Avoid implicit runtime downloads through bare
npxcommands. Install dependencies in a controlled build step and invoke the verified local executable. - Commit appropriate lockfiles, such as
package-lock.jsonand a hash-locked Python requirements file. - Verify package integrity using registry integrity metadata, cryptographic hashes, signatures, or an approved internal artifact repository.
- Configure package managers to use trusted registries explicitly and prevent dependency confusion through namespace and source controls.
- Review package provenance, maintainers, release history, lifecycle scripts, and transitive dependencies before approval.
- Run dependency code in a restricted sandbox with minimal filesystem access, narrowly scoped network access, and no unrelated secrets in the environment.
- Use a dedicated, least-privileged Figma token and avoid exposing it to dependency installation or lifecycle-script phases.
- Add automated dependency scanning and controlled update review so version changes cannot silently alter the executed payload.