T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:11
- Finding
- Unpinned Third-Party npm Package Executes with Access to Sensitive Account Data## Vulnerability Details **File Location**: `SKILL.md:11-16`, `SKILL.md:36-38`, and `SKILL.md:260-264` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium The Skill installs and executes the third-party npm package `@helmet-ai/helmet` without pinning an exact version or verifying package integrity. **Relevant code (`SKILL.md:11-16`):** ```yaml install: - id: node kind: node package: "@helmet-ai/helmet" bins: - helmet ``` **Relevant code (`SKILL.md:36-38`):** ```bash # Install npm install -g @helmet-ai/helmet ``` **Relevant code (`SKILL.md:260-264`):** ```bash npm install -g @helmet-ai/helmet@latest helmet --version # must be ≥ 0.2.0 ``` ### Technical Analysis Both the Skill installation metadata and documented installation commands resolve a mutable package release. The troubleshooting procedure explicitly uses the `@latest` distribution tag. Neither an exact reviewed version nor an integrity hash is supplied. npm package installation can execute package lifecycle scripts, and the installed `helmet` executable subsequently runs with the privileges of the invoking user. The external package implementation is not included in this project, so its credential handling, network behavior, and executable code cannot be independently audited from the supplied artifact. This is particularly sensitive because the Skill documentation states that the CLI handles library card numbers, PINs, authenticated cookie jars, account information, and state-changing operations such as placing or canceling holds. A compromised publishing account, malicious package release, or other supply-chain compromise could therefore introduce arbitrary code after this Skill has been reviewed. The wrapper in `scripts/helmet-cli.sh` forwards arguments safely using `"$@"`; no command-injection issue was found in that wrapper. The risk arises from trusting and executing the mutable external ...[truncated 1847 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `@helmet-ai/helmet` to a reviewed exact version in both the installation metadata and all documentation, rather than using an unqualified package name or `@latest`. 2. Remove the `npm install -g @helmet-ai/helmet@latest` recommendation. Provide a controlled upgrade process that identifies a specific reviewed version. 3. Use a lockfile and npm integrity metadata in a reproducible local installation. Verify the package tarball checksum before installation where the hosting framework permits it. 4. Vendor or include the CLI source in the audited project so its handling of PINs, cookies, network requests, and state-changing operations can be reviewed. 5. Prefer a project-local installation over a global mutable executable, and invoke the exact local binary. 6. Disable npm lifecycle scripts during installation when they are not required, for example with `npm install --ignore-scripts`, after confirming that this does not break legitimate functionality. 7. Establish a dependency review and update process that checks package provenance, publisher changes, release signatures or attestations, transitive dependencies, and security advisories before adopting a new version. 8. Document restrictive filesystem permissions for configuration and session data, and minimize the runtime environment's access to unrelated user files.