T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:178
- Finding
- Unpinned Third-Party Packages and Mutable GitHub Actions References## Vulnerability Details **File Location**: `SKILL.md`, lines 178–214 **Vulnerability Type**: Supply-chain exposure through unpinned executable dependencies **Risk Level**: Medium The Skill recommends GitHub Actions referenced by mutable major-version tags and package installation commands that do not specify reviewed versions or integrity constraints. ```yaml - uses: actions/checkout@v4 - uses: pnpm/action-setup@v3 with: { version: 9 } - uses: actions/setup-node@v4 with: node-version: 20 cache: 'pnpm' - run: pnpm install --frozen-lockfile - name: Cache Turborepo uses: actions/cache@v4 ``` ```bash # Install pnpm add -D openapi-typescript orval # Generate types npx openapi-typescript ./api/openapi.yaml -o ./src/types/api.d.ts ``` ### Technical Analysis References such as `actions/checkout@v4`, `pnpm/action-setup@v3`, `actions/setup-node@v4`, and `actions/cache@v4` are mutable tags rather than immutable commit SHAs. If an upstream repository or release process is compromised, a tag could resolve to modified action code after this Skill has been reviewed. The `pnpm add` command resolves package versions from the configured registry without requiring exact reviewed versions. Dependency installation may execute lifecycle scripts from the selected packages or their transitive dependencies. The subsequent `npx openapi-typescript` command executes installed package code. Although normal lockfile use can improve reproducibility, the presented addition command does not itself pin exact package versions or establish integrity review for newly resolved dependencies. No evidence shows that the currently referenced packages or actions are malicious. The finding concerns avoidable supply-chain risk in the recommended configuration. ### Attack Path 1. An attacker compromises a referenced package publisher, action repository, release account, or relevant distribution path. 2. The attacker publ ...[truncated 1360 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every GitHub Action to a reviewed full commit SHA rather than a mutable major-version tag. Keep the human-readable release in a comment, for example: ```yaml - uses: actions/checkout@<reviewed-full-commit-sha> # v4.x ``` 2. Use exact reviewed package versions when adding code-generation dependencies: ```bash pnpm add --save-exact -D openapi-typescript@<reviewed-version> orval@<reviewed-version> ``` 3. Commit `pnpm-lock.yaml` and require `pnpm install --frozen-lockfile` in CI so dependency resolution cannot silently modify the reviewed graph. 4. Execute the locally installed and locked binary with `pnpm exec openapi-typescript` rather than allowing `npx` to resolve or download an unexpected package. 5. Review dependency provenance, lifecycle scripts, maintainer changes, and transitive dependency updates before lockfile changes are merged. Use automated dependency scanning while requiring approval for executable supply-chain changes. 6. Apply least-privilege GitHub Actions permissions, expose secrets only to steps that require them, avoid secrets in workflows triggered by untrusted contributions, and restrict network or release credentials where practical. 7. Consider installation controls that suppress lifecycle scripts when they are unnecessary, followed by explicit allowlisting for dependencies that legitimately require build scripts.