T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:38
- Finding
- Execution and Global Installation of an Unpinned npm Dependency## Vulnerability Details **File Location**: `SKILL.md:38-42`; duplicated guidance in `references/skill-templates.md:12-13` **Vulnerability Type**: Unpinned third-party package retrieval and execution **Risk Level**: Medium ### Vulnerable Code From `SKILL.md:38-42`: ```sh # Run directly (no install needed) npx @microsoft/learn-cli search "semantic kernel overview" # Or install globally, then run npm install -g @microsoft/learn-cli ``` Corresponding guidance from `references/skill-templates.md:12-13`: ```markdown Run directly with `npx @microsoft/learn-cli <command>` or install globally with `npm install -g @microsoft/learn-cli`. ``` ### Technical Analysis The skill instructs agents to retrieve and execute `@microsoft/learn-cli` without specifying an audited version or validating package integrity. Consequently, package resolution depends on the mutable state of the npm registry at execution time. The `npx` command may download and immediately execute the package's current resolved release. The global installation alternative also downloads mutable third-party code and installs it into the user's global npm environment. Package code and installation lifecycle behavior can therefore differ from what existed when this skill was audited. This creates a supply-chain trust boundary: compromise of the package, publisher account, npm distribution process, or a future package release could cause agents following the documented fallback to execute attacker-controlled code. No evidence establishes that the current package is malicious; the vulnerability is the unsafe, unpinned execution pattern. ### Attack Path 1. An attacker compromises the package publisher account, package repository, release pipeline, or another relevant npm distribution component. 2. The attacker publishes a malicious version of `@microsoft/learn-cli`, potentially including malicious CLI logic or installation lifecycle scripts. 3. An agent ...[truncated 1256 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to a reviewed exact version rather than resolving the latest available release: ```sh npx --yes @microsoft/learn-cli@EXACT_AUDITED_VERSION search "semantic kernel overview" ``` 2. Prefer declaring the CLI in a project manifest and committing a lockfile so package versions and transitive dependencies are reproducible. 3. Use npm integrity metadata and a trusted internal registry or approved package proxy where available. 4. Remove the recommendation to install the package globally. Execute a locally locked dependency through a package script or equivalent controlled environment. 5. Review package provenance, publisher identity, lifecycle scripts, and release signatures before approving version updates. 6. Run the CLI with least privilege in a sandbox or container that has restricted filesystem, credential, and network access. 7. Apply the same hardened command and version policy consistently in both `SKILL.md` and `references/skill-templates.md`.