T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:12
- Finding
- Unpinned Global Installation of a Third-Party CLI Package## Vulnerability Details **File Location**: `SKILL.md:12-16` **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium ### Vulnerable Code ```markdown If `linkedin` is not available, install it: ```bash npm install -g @linkedapi/linkedin-cli ``` ``` ### Technical Analysis The Skill instructs the Agent to install the latest available version of `@linkedapi/linkedin-cli` from the npm registry. No fixed version, integrity hash, lockfile, package provenance check, or reviewed artifact is specified. The `-g` option installs the package into the global npm environment. Depending on local configuration, this may modify shared executable paths and expose the package to other sessions. npm installation can also execute package lifecycle scripts with the privileges of the invoking user. This does not establish that the named package is malicious. However, the installation method creates a supply-chain trust boundary that is not constrained to a reviewed package version. A compromised maintainer account, registry package, transitive dependency, or unexpectedly changed future release could introduce arbitrary code after the Skill itself has been audited. ### Attack Path 1. An attacker compromises the npm package, its maintainer account, or one of its dependencies. 2. The attacker publishes a malicious release under the existing package name. 3. The Agent follows the Skill instruction and runs `npm install -g @linkedapi/linkedin-cli`. 4. npm retrieves the current malicious release rather than a previously reviewed version. 5. Malicious lifecycle or runtime code executes with the invoking user's privileges. 6. The code may read accessible files, capture Linked API credentials, alter globally installed tooling, or send account data to an attacker-controlled service. ### Impact Assessment Successful exploitation could obtain the privileges of the user running npm. The affected scope ...[truncated 481 chars]
- Remediation
- ## Remediation Suggestions - Pin the CLI to a specifically reviewed version, for example `@linkedapi/linkedin-cli@X.Y.Z`. - Verify the downloaded package against an approved integrity digest and maintain a lockfile or equivalent dependency manifest. - Avoid global installation. Install the dependency in an isolated, dedicated working directory or container with minimal filesystem and network access. - Review all transitive dependencies and verify package provenance, publisher identity, signatures, and registry source. - Disable npm lifecycle scripts during installation where compatible, then explicitly permit only reviewed setup operations. - Run the CLI as a dedicated unprivileged user and deny access to unrelated credentials and files. - Require explicit user approval before installing or upgrading the dependency.