T08 · Insecure Dependencies
- Location
SKILL.md:334- Finding
Unpinned npm Dependency Installation Through Agent Execution
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 334–345
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: MediumVulnerable Code
bash npm install -D tailwindcssThe supporting instruction at line 345 states that the Agent may use the
exectool to run npm commands while configuring Tailwind CSS.Technical Analysis
The Skill recommends installing
tailwindcsswithout specifying an exact, reviewed version. Consequently, package resolution depends on mutable npm registry state at execution time. The installed contents can differ from those present when the Skill was audited.Because the Skill declares access to the
exectool and explicitly permits npm command execution, an Agent following these instructions may download and install unreviewed third-party content. npm installations can also invoke package lifecycle scripts unless script execution is disabled. This creates a supply-chain exposure if the package, one of its transitive dependencies, the publisher account, or the package registry is compromised.The finding does not demonstrate that the current
tailwindcsspackage is malicious. The vulnerability is the unsafe, unpinned installation procedure and the absence of integrity, lockfile, provenance, or lifecycle-script controls.Attack Path
- A user invokes the Skill for Tailwind CSS configuration.
- The Agent follows the dependency guidance and uses its declared
execcapability. - The Agent runs
npm install -D tailwindcss. - npm resolves the package version and dependency graph from the registry at execution time.
- If the resolved package, a transitive dependency, or the registry response has been compromised, attacker-controlled package content is downloaded.
- Malicious lifecycle code may execute during installation, or malicious installed code may execute later when the project invokes the dependency.
- The payload runs wit ...[truncated 704 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not automatically install dependencies for a Skill whose principal functionality is static design guidance.
- Require explicit user confirmation before executing any package-manager command.
- Pin Tailwind CSS to an exact version that has been reviewed, rather than resolving the latest available release:
bash npm install --save-dev --save-exact --ignore-scripts tailwindcss@<reviewed-version> - Commit and enforce a reviewed lockfile, such as
package-lock.json, and usenpm ciin repeatable environments. - Verify package integrity and provenance before installation, including the expected registry, publisher, checksums, and dependency graph.
- Disable npm lifecycle scripts during installation unless a reviewed dependency explicitly requires them.
- Execute package installation in a restricted sandbox without sensitive environment variables, broad filesystem access, or unnecessary network permissions.
- Document the exact supported version and establish a review process before updating it.