T08 · Insecure Dependencies
Error
- Location
- SKILL.md:13
- Finding
- Execution of Unverified External Project and Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 13–21 **Vulnerability Type**: Unverified third-party dependency installation and execution **Risk Level**: High ### Vulnerable Code ```markdown ## Installation The tool should be installed globally or in the workspace. If not installed: ```bash cd ~/Code/bahn-cli && npm install ``` ## Usage Search train connections: ```bash cd ~/Code/bahn-cli && node index.js search "<from>" "<to>" [options] ``` ``` ### Technical Analysis The Skill instructs the Agent to enter `~/Code/bahn-cli`, install that project's dependencies, and execute its `index.js` file. However, the audited package does not include the referenced project, its source code, a package manifest, or a lockfile. It also does not identify an authenticated repository, immutable commit, or verified release from which the external project must originate. Consequently, the Agent trusts whatever content happens to occupy the mutable `~/Code/bahn-cli` path. Running `npm install` may download unreviewed dependencies and execute package lifecycle scripts such as `preinstall`, `install`, and `postinstall`. The subsequent `node index.js` command directly executes code from the same unverified directory. This creates a supply-chain execution boundary outside the audited Skill. The effective code may differ from what the Skill author intended and cannot be validated from the files in the project. ### Attack Path 1. An attacker, compromised development environment, or malicious setup process creates or modifies `~/Code/bahn-cli`. 2. The substituted project contains a malicious lifecycle script, malicious dependency, or modified `index.js`. 3. An Agent loads the Skill and follows its installation guidance. 4. `npm install` resolves the attacker's dependencies and may execute malicious lifecycle scripts. 5. Alternatively or additionally, the Agent invokes the documented search command and directly executes the substituted `index.js`. 6. ...[truncated 1170 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Bundle the reviewed `bahn-cli` implementation and its dependency manifests within the Skill package so the executed code is part of the audited artifact. 2. If an external project is required, specify its authenticated official source and pin it to an immutable commit or cryptographically verified release. 3. Include a committed lockfile with integrity metadata and use `npm ci` rather than unconstrained `npm install`. 4. Use `npm ci --ignore-scripts` when dependency lifecycle scripts are not required. If scripts are required, review and explicitly allow only the necessary scripts. 5. Resolve the executable path relative to the installed Skill directory instead of relying on a mutable home-directory path such as `~/Code/bahn-cli`. 6. Verify the expected repository revision, file hashes, package identity, and lockfile before installing dependencies or executing `index.js`. 7. Run the tool with least privilege in a restricted environment that limits filesystem, credential, and network access. 8. Document the precise supported version and update process so dependency changes receive security review before deployment. ]]>