T08 · Insecure Dependencies
- Location
SKILL.md:247- Finding
Unpinned and Unverified DNS CLI Dependencies Create a Supply-Chain Risk
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:95-100, 116-130, 184-196, 243-248
Vulnerability Type: Unverified and unpinned third-party dependencies
Risk Level: MediumThe Skill directs an AI agent to execute a
volcengine-dnscommand and states that a required Volcengine SDK should be installed using pip or npm. However, the project contains no implementation of this executable and does not identify an official package name, trusted registry, publisher, pinned version, lock file, checksum, or signature.Relevant command invocation (
SKILL.md:95-100):bash volcengine-dns add \ --zone "example.com" \ --record "api.example.com" \ --type A \ --value "192.168.1.100" \ --ttl 300Dependency declaration (
SKILL.md:243-248):markdown | Dependency | Type | Required | Acquisition method | |:-----|:-----|:-----|:-----| | LLM API | API | Required | Provided by the agent's built-in LLM | | Volcengine SDK | Library | Required | Install with pip/npm | | dig/nslookup | Tool | Optional for verification | Provided by the operating system |Technical Analysis
The package contains only
SKILL.md; it does not ship an auditablevolcengine-dnsimplementation. The generic instruction to install the required SDK through “pip/npm” does not provide enough information to authenticate the dependency or distinguish an official package from a typosquatted or dependency-confusion package.This becomes security-sensitive because the documented workflow configures Volcengine access credentials in environment variables and then invokes the unspecified executable to create, update, and delete authoritative DNS records. A malicious package selected while attempting to satisfy the undocumented dependency could read those inherited environment variables during installation or execution.
The existence of an actively malicious dependency is not established by the repository. The confirmed ...[truncated 1972 chars]
- Remediation
View remediation
Remediation Suggestions
-
Identify the authoritative CLI and SDK explicitly:
- Provide the exact package name.
- Specify the official pip or npm registry.
- Identify the trusted publisher and official source repository.
- Document how users can verify that the package is authentic.
-
Pin dependency versions:
- Use an exact reviewed version rather than an unconstrained installation.
- Supply a lock file where supported.
- Provide cryptographic hashes or signature-verification instructions.
-
Replace the generic “pip/npm installation” instruction with an exact installation command that does not allow ambiguous package selection.
-
Prefer bundling a minimal, auditable implementation with the Skill or referencing an official vendor-distributed executable through a verified URL and integrity value.
-
Run DNS operations with a dedicated least-privilege Volcengine identity:
- Restrict access to the required hosted zones.
- Permit only the required DNS actions.
- Do not reuse credentials that provide access to unrelated cloud services.
- Use short-lived credentials where supported.
-
Avoid exposing long-lived secrets to package installation processes. Install and verify dependencies before injecting DNS credentials into the runtime environment.
-
Require explicit user confirmation before record updates or deletions, and display the target zone, record, old value, and proposed value before execution.
-
Add provenance and integrity checks to the documented setup procedure and fail closed when the executable path, package identity, or installed version does not match the approved dependency.
-