T08 · Insecure Dependencies
Error
- Location
- README.md:10
- Finding
- Unpinned Third-Party Installation Commands Permit Supply-Chain Code Substitution<![CDATA[ ## Vulnerability Details **File Location**: `README.md:10-18` **Vulnerability Type**: Unpinned remote dependencies and mutable installation sources **Risk Level**: High ### Vulnerable Code ```markdown Install into Claude Code or Cursor with: ```bash npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/self-funding-setup ``` Or via Clawhub: ```bash npx clawhub@latest install self-funding-setup ``` ``` ### Technical Analysis The documented installation procedures execute packages resolved through `npx` without pinning them to audited, immutable versions. The second command explicitly selects `clawhub@latest`, allowing the npm registry to provide a different package version each time the command is run. The first command invokes the unversioned `skills` package and installs skill content from a mutable GitHub branch path rather than a specific commit SHA. Consequently, the effective code and skill instructions installed on a user's system can change after this audit. The risk is not limited to the audited Markdown files: `npx` may download and execute package lifecycle or command code supplied by the package registry. The remote repository content may also be replaced without changing the command shown in the README. ### Attack Path 1. An attacker compromises the npm account, package publication process, GitHub repository, or a maintainer account associated with one of the referenced components. 2. The attacker publishes a malicious version under the package's current `latest` tag, changes the unpinned `skills` package, or modifies the repository branch referenced by the URL. 3. A user follows the README and runs one of the documented `npx` commands. 4. `npx` resolves and executes the attacker's updated package code under the user's local account. 5. The malicious installer can modify project files, steal locally accessible credentials, alter installed agent instructions, or execute other commands available to that user ...[truncated 706 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every npm package to an exact audited version, for example: ```bash npx clawhub@X.Y.Z install self-funding-setup ``` 2. Pin GitHub-hosted content to a full commit SHA rather than a mutable branch: ```text https://github.com/wpank/Agentic-Uniswap/tree/<full-commit-sha>/.ai/skills/self-funding-setup ``` 3. Document SHA-256 checksums or signed release provenance for downloaded artifacts. 4. Avoid executing packages directly from the network where practical. Download the package, verify its integrity and signature, inspect its contents, and then install it. 5. Use npm lockfiles and integrity metadata for any maintained dependency set. 6. Enable registry account protections, including multi-factor authentication, provenance attestations, and restricted publication tokens. 7. Add automated monitoring for ownership changes, unexpected releases, and modifications to referenced repository content. ]]>