T08 · Insecure Dependencies
Warning
- Location
`; explain and correct each error before building. 5. **Correctly invoke the CLI to build**: - Single city: `npx trip-packer build -d xxx.json -o xxx-map.html` - Multiple cities: use multiple `-d` arguments and optionally `--default-city` - To generate sharing images, append `--images` ``` The original file expresses these instructions in Chinese, including the following executable commands: ```bash npx trip-packer validate -d <file> npx trip-packer build -d xxx.json -o xxx-map.html ``` `plannin ...[truncated 3224 chars]:25- Finding
Unpinned npm Package Is Downloaded and Executed Through npx
- Content
View full analysis
`; explain and correct each error before building. 5. **Correctly invoke the CLI to build**: - Single city: `npx trip-packer build -d xxx.json -o xxx-map.html` - Multiple cities: use multiple `-d` arguments and optionally `--default-city` - To generate sharing images, append `--images` ``` The original file expresses these instructions in Chinese, including the following executable commands: ```bash npx trip-packer validate -d npx trip-packer build -d xxx.json -o xxx-map.html ``` `planning-guide.md:82-91`: ```bash # Validate data npx trip-packer validate -d kyoto.json # Build single-city HTML npx trip-packer build -d kyoto.json -o kyoto-map.html # Build multi-city HTML npx trip-packer build -d kyoto.json -d tokyo.json --default-city kyoto -o japan-trip.html ``` ### Technical Analysis The skill directs the agent to invoke `trip-packer` through `npx` without specifying an exact package version. If the package is not already installed locally, `npx` can retrieve it from the configured npm registry and immediately execute its code. The project does not contain a `package.json`, lockfile, package integrity record, or other mechanism that binds execution to a reviewed artifact. It also does not verify the package publisher, provenance, checksum, or registry source. Therefore, the code executed during validation and building may change after this skill has been audited. This creates a supply-chain trust boundary: the commands appear to perform routine validation and HTML generation, but their effective implementation is controlled by whichever packa ...[truncated 2042 chars]- Remediation
View remediation