T08 · Insecure Dependencies
- Location
SKILL.md:94- Finding
Unpinned Third-Party Package Is Automatically Installed and Executed with Google Workspace Access
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:94-101
Vulnerability Type: Unpinned and automatically executed third-party dependency
Risk Level: HighVulnerable Code
bash # Dependency installation npm install -g @presto-ai/google-workspace-toolkit # Register the tool service gwtool config add google-workspace \ --command "npx" \ --arg "-y" \ --arg "@presto-ai/google-workspace-toolkit" \ --scope homeThe same unpinned package registration pattern is repeated at
SKILL.md:160-167andSKILL.md:197-204.Technical Analysis
The Skill directs users to globally install
@presto-ai/google-workspace-toolkitwithout an exact version or integrity constraint. It then configuresnpx -yto execute that package automatically. Because no version is specified, future installations or invocations can resolve to a newer, materially different package release than the one originally reviewed.The
-yoption suppresses the interactive installation confirmation normally presented bynpx. The global installation also exposes the package installation lifecycle to the user's broader Node.js environment. No lockfile, package integrity hash, verified source revision, registry provenance requirement, or auditable implementation is included in the project.This dependency operates in a security-sensitive context. According to the Skill documentation, it authenticates through Google OAuth, stores credentials under
~/.config/google-workspace-toolkit/, and can read or send Gmail messages, access calendars, and search or download Google Drive files. Consequently, compromise of the package publisher, npm account, release process, or resolved package version could place both OAuth credentials and Workspace data at risk.Attack Path
- An attacker compromises the npm publisher account, release pipeline, or another component used to publish
@presto-ai/google-workspace-toolkit. - The ...[truncated 1935 chars]
- An attacker compromises the npm publisher account, release pipeline, or another component used to publish
- Remediation
View remediation
Remediation Suggestions
-
Pin the dependency to a reviewed, immutable version, for example:
bash npm install -g @presto-ai/google-workspace-toolkit@1.2.3The selected version must be independently reviewed before publication of the Skill.
-
Include and enforce a lockfile where the deployment model permits it. Record and verify the package tarball integrity hash rather than relying only on a mutable version tag.
-
Remove
npx -yfrom persistent tool registration. Install the reviewed package explicitly and configure the tool to execute the pinned local binary without allowing automatic downloads. -
Avoid global installation. Run the dependency from a dedicated project directory, isolated environment, container, or restricted operating-system account.
-
Publish or reference auditable source code and a specific source revision corresponding to the distributed npm package. Enable npm provenance and verify package signatures or attestations in the installation workflow.
-
Request only the minimum OAuth scopes required for each operation. Separate read-only capabilities from write capabilities such as sending email or creating events, and clearly display requested scopes before authorization.
-
Protect stored credentials with restrictive filesystem permissions and operating-system credential storage where available. Do not keep refresh tokens in broadly readable plaintext files.
-
Add dependency monitoring, publisher account multi-factor authentication, release approval controls, and automated alerts for ownership, version, integrity, or provenance changes.
-
Document a response procedure for dependency compromise, including revoking Google OAuth grants, deleting local credentials, invalidating refresh tokens, removing the registered service, and reinstalling only a verified release.
-