T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:64
- Finding
- Unverified npm Package Download and Execution via npx## Vulnerability Details **File Location**: `SKILL.md`, lines 64-70 **Vulnerability Type**: Supply-chain exposure through automatic retrieval and execution of a third-party npm package **Risk Level**: Medium ```bash npx -y sentisense@0.52.0 insiders NVDA --days 90 npx -y sentisense@0.52.0 insiders NVDA --days 180 --json npx -y sentisense@0.52.0 insiders NVDA --full # all rows in plain output, not the top 15 ``` The associated authentication workflow also instructs users to execute the same remotely retrieved CLI: ```bash npx -y sentisense@0.52.0 auth "$SENTISENSE_API_KEY" ``` ### Technical Analysis The `npx -y` command automatically downloads and executes the specified npm package without interactive confirmation. Pinning `sentisense` to version `0.52.0` reduces unexpected direct-version changes, but it does not independently verify package integrity, establish that the package was reviewed, or protect against compromise of the publisher account, npm distribution infrastructure, package contents, or transitive dependencies. The CLI runs with the invoking user's permissions. It may inherit `SENTISENSE_API_KEY` and other environment variables available to the process. The documented authentication operation additionally stores the API credential under `~/.config/sentisense/`. Although the documentation states that the resulting file uses mode `600`, executing an unverified dependency still places the credential and other user-readable resources within reach of that process. No evidence establishes that the current package is malicious. The vulnerability is the trust boundary created by automatically retrieving and executing third-party code without an independent integrity or provenance check. ### Attack Path 1. An agent or user follows the documented workflow and runs an `npx -y sentisense@0.52.0` command. 2. `npx` retrieves the package and any required dependencies from the configured npm registry. 3. Package lifecycle behavior or CLI code executes ...[truncated 1371 chars]
- Remediation
- ## Remediation Suggestions 1. Prefer the documented direct HTTPS `GET` API endpoints using a trusted, already-installed HTTP client instead of downloading and executing an npm CLI at runtime. 2. If the CLI is required, vendor and review the exact package source and its complete transitive dependency tree before deployment. 3. Publish and verify a cryptographic digest or signed provenance statement for the reviewed package archive. Fail closed if verification does not succeed. 4. Install the reviewed artifact from an approved internal registry or immutable local package cache rather than dynamically retrieving it during skill execution. 5. Disable npm lifecycle scripts during installation where the package remains functional, for example by applying an appropriate `ignore-scripts` policy. 6. Run the CLI inside a restricted sandbox or container with: - No unnecessary host filesystem access. - Only the required `SENTISENSE_API_KEY` exposed. - No unrelated environment variables or credentials. - Network egress restricted to the documented SentiSense API endpoint and required package source during controlled installation. - A non-privileged, disposable user identity. 7. Avoid persistent API-key storage unless explicitly requested. When storage is needed, retain restrictive file permissions and document a reliable credential-removal procedure. 8. Generate and enforce a dependency lockfile or equivalent immutable dependency manifest for any approved local installation.