T08 · Insecure Dependencies
Error
- Location
- SKILL.md:12
- Finding
- Unpinned Runtime-Downloaded CLI Creates a Supply-Chain Execution Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 12-16; additional invocation at lines 124-126 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: High ### Vulnerable Code ```bash npx @esignglobal/envelope-cli <command> ``` The same unpinned package is used in the envelope-sending command: ```bash npx @esignglobal/envelope-cli send-envelope --file <filePath> --signers '<signersJson>' [--subject <subject>] --confirm ``` ### Technical Analysis The skill directs the agent to resolve and execute `@esignglobal/envelope-cli` through `npx` without specifying an exact package version. It provides no lockfile, integrity hash, provenance verification, or requirement that an audited local installation be used. Depending on the local npm and `npx` configuration, the command can download and execute the package version currently resolved by the npm registry. This makes the effective executable mutable after the skill has been reviewed. A compromised package, compromised publisher account, malicious replacement release, or unexpected future version could execute arbitrary code with the privileges of the agent process. The CLI is also expected to run while `ESIGNGLOBAL_APIKEY` is present in the environment and while a sensitive local PDF is accessible. Consequently, compromise of the dependency would expose both authentication material and document data. ### Attack Path 1. An attacker compromises the package publisher, registry distribution path, or a version selected for the unpinned package. 2. The malicious package or release is published under `@esignglobal/envelope-cli`. 3. An agent follows the skill and executes the documented `npx` command. 4. `npx` resolves and, where necessary, downloads the attacker-controlled package. 5. Package installation hooks or CLI entry-point code execute with the agent's operating-system privileges. 6. The malicious code reads `ESIGNGLOBAL_APIKEY`, accesses the selected PDF or other files ava ...[truncated 802 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the CLI to a reviewed exact version, for example: ```bash npx --no-install @esignglobal/envelope-cli <command> ``` The package should first be installed at an exact version through a controlled dependency manifest. 2. Add a `package-lock.json` or equivalent lockfile containing registry integrity metadata, and enforce immutable or reproducible installation in deployment. 3. Prevent implicit runtime downloads by using `npx --no-install` or directly invoking an already installed, verified executable. 4. Verify package provenance, publisher identity, signatures or attestations where available, and expected integrity hashes before deployment. 5. Review new package versions before updating the pinned version. 6. Run the CLI in a restricted environment with access only to the selected PDF and required network destination. 7. Provide the API key with the minimum permissions necessary and rotate it immediately if dependency compromise is suspected. ]]>