T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:16
- Finding
- Unpinned Third-Party Dependencies and Repository Code Are Installed and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:16-24` and `SKILL.md:38-44` **Vulnerability Type**: Unpinned and mutable supply-chain dependencies **Risk Level**: Medium ### Vulnerable Code ```yaml install: - kind: node package: "@notionhq/client" bins: [] - kind: node package: "agent-relay" bins: [] - kind: node package: "better-sqlite3" bins: [] ``` ```bash git clone https://github.com/TheAgentAcademy/agent-relay-orchestrator.git cd agent-relay-orchestrator npm install cp .env.example .env # Edit .env with your Notion credentials npm start ``` ### Technical Analysis The Skill declares three npm dependencies without exact versions and instructs users to clone and execute an external repository without pinning a reviewed commit or release. Consequently, the code installed and executed can change after this Skill has been audited. Running `npm install` may download mutable transitive dependencies and execute npm lifecycle scripts. Running `npm start` then executes the fetched repository with the permissions of the invoking user. The external repository, its lockfile, lifecycle scripts, and runtime implementation were not included in the audited project, so their behavior could not be verified. This is a supply-chain weakness rather than evidence that the named packages or repository are currently malicious. ### Attack Path 1. An attacker compromises the external repository, an npm package publisher, or a transitive dependency. 2. The attacker publishes or commits a modified payload while retaining the expected package or repository identity. 3. A user follows the documented setup instructions or permits the Skill framework to install the declared dependencies. 4. `npm install` retrieves the mutable dependency version and may execute attacker-controlled lifecycle scripts. 5. `npm start` executes the downloaded application code under the invoking user's account. 6. The malicious code can access resources avai ...[truncated 779 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every npm dependency to an exact reviewed version rather than relying on mutable version resolution. 2. Include and verify a lockfile, and use `npm ci` instead of `npm install` for reproducible installations. 3. Pin the external repository to a specific reviewed commit hash or cryptographically signed release. 4. Publish and verify checksums or signatures for downloaded source archives and release artifacts. 5. Use `npm ci --ignore-scripts` where lifecycle scripts are unnecessary. If scripts are required, review and explicitly allow each one. 6. Audit all direct and transitive dependencies using tools such as `npm audit`, an SBOM scanner, and package provenance verification. 7. Run the orchestrator under a dedicated low-privilege account or sandbox with restricted filesystem and network access. 8. Provide secrets only at runtime, scope the Notion token to the minimum required permissions, and avoid exposing unrelated credentials to the process. 9. Vendor or bundle the reviewed implementation with the Skill when feasible so the audited artifact corresponds to the code that will execute. ]]>