T08 · Insecure Dependencies
Error
- Location
- SKILL.md:19
- Finding
- Unpinned SDK Dependency Is Entrusted with Wallet Credentials<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 19-21, 27-29, 41-46, and 57-78 **Vulnerability Type**: Unpinned security-sensitive third-party dependency **Risk Level**: High ### Vulnerable Code ```bash npm install @oneshot-agent/sdk ``` ```typescript // Reads CDP_API_KEY_ID, CDP_API_KEY_SECRET, CDP_WALLET_SECRET from env const agent = await OneShot.create({ cdp: true }); ``` ```typescript const agent = new OneShot({ privateKey: process.env.ONESHOT_WALLET_PRIVATE_KEY }); ``` ```bash export CDP_API_KEY_ID="your-api-key-id" export CDP_API_KEY_SECRET="your-api-key-secret" export CDP_WALLET_SECRET="your-wallet-secret" ``` ```typescript const agent = await OneShot.create({ cdp: true }); ``` ```bash export ONESHOT_WALLET_PRIVATE_KEY="0xYourPrivateKey" ``` ```typescript const agent = new OneShot({ privateKey: process.env.ONESHOT_WALLET_PRIVATE_KEY }); ``` ### Technical Analysis The installation command does not specify an exact package version or integrity value. Consequently, the package resolved at installation time can differ from the version originally reviewed. The SDK is then explicitly given access to CDP wallet credentials or a raw wallet private key. Because npm packages execute within the consuming process, a compromised, malicious, or unexpectedly changed SDK release could read these credentials, transmit them to an external service, alter transaction parameters, or request unauthorized signatures. Transitive dependencies can create the same exposure. The repository contains only documentation, so the implementation of `@oneshot-agent/sdk` could not be reviewed during this audit. There is no evidence in `SKILL.md` that the current package is malicious; the confirmed issue is the unsafe trust model created by installing an unpinned package and granting it wallet authority. ### Attack Path 1. An attacker compromises the SDK publisher account, release pipeline, package, or one of its transitive dependencies. 2. The attack ...[truncated 1005 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the SDK to a reviewed exact version rather than using an unconstrained installation: ```bash npm install --save-exact @oneshot-agent/sdk@<reviewed-version> ``` 2. Commit and enforce a lockfile, and use `npm ci` in controlled deployments. 3. Verify registry provenance, package signatures where supported, and package integrity hashes. 4. Audit the SDK source, release artifacts, lifecycle scripts, and transitive dependencies before granting access to production credentials. 5. Prefer isolated CDP credentials with only the minimum required permissions over raw private keys. 6. Use a dedicated low-balance wallet with spending, destination, rate, and transaction-value limits. 7. Keep production credentials outside general-purpose process environments where possible; use a managed secret store and short-lived credentials. 8. Require explicit human approval for high-value purchases, arbitrary destinations, or production-mode transactions. 9. Monitor wallet activity and rotate or revoke credentials immediately if package compromise is suspected. ]]>