T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:18
- Finding
- Unpinned Third-Party Packages Are Installed and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 18-27 **Vulnerability Type**: Supply-chain exposure through unpinned npm packages **Risk Level**: Medium ### Vulnerable Code ```markdown Install the open-source CLI once and sign in; the CLI stores the key, so never ask the user to paste an API key into the chat: ```bash npm install -g @wavespeed/cli wavespeed login # opens https://wavespeed.ai/accesskey and stores the key wavespeed status # confirms you are signed in ``` For CI or one-off shells, `WAVESPEED_API_KEY` in the environment also works. Prefer MCP tools over shell commands? The same platform is exposed by [`@wavespeed/mcp`](https://github.com/WaveSpeedAI/mcp-server) (`npx -y @wavespeed/mcp`; tools `search_models`, `get_model_schema`, `get_price`, `upload_file`, `run_model`, `get_prediction`). It shares the CLI's stored login. ``` ### Technical Analysis The instructions install `@wavespeed/cli` globally and execute `@wavespeed/mcp` through `npx -y` without pinning either package to a reviewed version or verifying package integrity. By default, npm resolves an unversioned package to the registry's current applicable release. Package installation may invoke npm lifecycle scripts, while `npx -y` can automatically download and execute the package binary without an interactive confirmation step. Consequently, the code executed by users can change after the skill has been reviewed. This creates a supply-chain trust boundary: compromise of the package publisher, npm account, registry distribution path, or a transitive dependency could result in malicious code being delivered through otherwise legitimate-looking setup instructions. The global installation further broadens the package's local availability. Because the CLI stores authentication material and can also use `WAVESPEED_API_KEY`, malicious package code executing in the same user context may attempt to access those credentials. ...[truncated 1500 chars]
- Remediation
- ## Remediation Suggestions 1. Pin both packages to exact, reviewed versions, such as `@wavespeed/cli@X.Y.Z` and `@wavespeed/mcp@X.Y.Z`, rather than implicitly selecting the latest release. 2. Record and verify package integrity hashes or use a lockfile backed by a controlled installation process. 3. Install dependencies locally in a dedicated project or isolated environment instead of globally wherever practical. 4. Replace automatic `npx -y` execution with an explicitly installed, pinned dependency whose provenance and dependency tree have been reviewed. 5. Review npm lifecycle scripts and transitive dependencies before approving version updates. Use package auditing and provenance verification in CI. 6. Run the tools with least privilege in a restricted environment that exposes only necessary files and network destinations. 7. Keep `WAVESPEED_API_KEY` out of broadly inherited process environments. Use a narrowly scoped secret mechanism and rotate the credential if package compromise is suspected. 8. Document a controlled update procedure so package upgrades require review rather than silently changing the executable code used by the skill.