T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:51
- Finding
- Third-Party npm Package Is Downloaded and Executed at Runtime## Vulnerability Details **File Location**: `SKILL.md`, lines 51 and 69-73 **Vulnerability Type**: Unsafe third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```markdown - Any HTTP client, or no install at all via the official CLI (`npx -y sentisense@0.52.0`). Plain `curl` works, or Python 3.8+ using only the standard library. ``` ```bash npx -y sentisense@0.52.0 analysts NVDA --coverage npx -y sentisense@0.52.0 analysts NVDA --days 30 npx -y sentisense@0.52.0 analyst quinn-bolton --calls npx -y sentisense@0.52.0 search Tesla --type company npx -y sentisense@0.52.0 analysts NVDA --coverage --json ``` ### Technical Analysis The Skill repeatedly recommends `npx -y`, which can retrieve and immediately execute an npm package without an interactive installation or review step. Pinning the package to version `0.52.0` improves reproducibility, but it does not independently authenticate the artifact, verify its integrity, or protect against compromise of the package, its transitive dependencies, the publisher account, or the package registry. The `-y` option suppresses confirmation. Consequently, following the Skill can cross from read-only HTTPS data retrieval into local third-party code execution. This exceeds the minimum privilege needed for the declared functionality because the document also states that all supported operations can be performed through read-only REST requests using `curl` or Python's standard library. The audit did not establish that the named npm package is malicious. The vulnerability is the unsafe execution model and resulting supply-chain exposure. ### Attack Path 1. An attacker compromises the npm publisher, package artifact, registry delivery path, or a dependency resolved by the package. 2. The user or Agent follows the Skill and runs an documented `npx -y sentisense@0.52.0` command. 3. npm retrieves the package and any required dependencies from the external regist ...[truncated 886 chars]
- Remediation
- ## Remediation Suggestions 1. Make direct HTTPS requests with `curl` or a standard-library client the default and recommended execution path. 2. Do not automatically invoke `npx -y` from an Agent workflow. 3. If the CLI remains supported, require an explicit, separately reviewed installation step rather than download-and-execute behavior. 4. Verify the package publisher, package provenance, cryptographic integrity, and complete transitive dependency tree. 5. Use a lockfile with integrity hashes in a controlled project environment. 6. Disable npm lifecycle scripts where practical, for example by using an installation policy equivalent to `--ignore-scripts`, after confirming that the package does not legitimately require them. 7. Run the CLI in a sandbox with restricted filesystem access, a minimal environment, and network access limited to the documented SentiSense host. 8. Pass only the required API credential into the sandbox and remove unrelated secrets from its environment.