T08 · Insecure Dependencies
Warning
- Location
- README.md:9
- Finding
- Unpinned Remote Dependencies in Installation Commands<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, lines 9–19 **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Code ```bash Install into Claude Code or Cursor with: ```bash npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/deploy-agent-token ``` Or via Clawhub: ```bash npx clawhub@latest install deploy-agent-token ``` ``` ### Technical Analysis The documented installation procedures rely on remote, mutable resources without pinning them to reviewed versions or verifying their integrity. The first command executes the unpinned `skills` npm CLI and installs Skill content from the mutable `main` branch of a GitHub repository. The second command explicitly executes the mutable `latest` release of the `clawhub` npm package. Neither command specifies a trusted package version, immutable Git commit, cryptographic checksum, or signature. Because `npx` downloads and executes package code, the effective code run by these commands can change after this audit. A compromised npm publisher account, malicious package update, compromised GitHub account, or modification to the repository's `main` branch could introduce attacker-controlled code or Skill instructions. No evidence was found that the currently audited files contain a malicious payload. The risk arises from the mutable, unverified installation chain. ### Attack Path 1. An attacker compromises the relevant npm publisher account, package distribution channel, GitHub repository, or maintainer credentials. 2. The attacker publishes a malicious CLI release or modifies content under the referenced GitHub `main` branch. 3. A user follows the installation instructions and executes one of the documented `npx` commands. 4. `npx` downloads and executes the modified CLI with the privileges of the invoking user. 5. The malicious installer can alter files accessible to that user, install manipulated Skill instructions, access user-read ...[truncated 827 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every npm CLI to an exact reviewed version instead of relying on an implicit version or `@latest`, for example: ```bash npx skills@<reviewed-version> add ... npx clawhub@<reviewed-version> install deploy-agent-token ``` 2. Replace the mutable GitHub `main` branch reference with an immutable, reviewed commit SHA or signed release tag. 3. Publish and verify cryptographic checksums or signatures for downloaded Skill artifacts before installation. 4. Prefer installing reviewed CLI dependencies through a lockfile and then invoking the local pinned binary rather than downloading and executing packages directly through `npx`. 5. Review package lifecycle scripts and the complete dependency tree before approving new versions. 6. Run installation in a least-privileged, isolated environment without production credentials or sensitive environment variables. 7. Establish a controlled update process in which new dependency versions and upstream Skill revisions are audited before documentation is updated. ]]>