T08 · Insecure Dependencies
Error
- Location
- SKILL.md:45
- Finding
- Unpinned Global Installation of an Unaudited Third-Party CLI Package<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md:45-48` - `INSTALL.md:14` - `README.md:15-18` **Vulnerability Type**: Unpinned and unaudited third-party dependency installed globally **Risk Level**: High ### Vulnerable Code Snippets `SKILL.md:45-48`: ```markdown ### Install EdithAI CLI First, install the EdithAI CLI tool: ```bash npm install -g @xin9min9/edithai-cli ``` ``` `INSTALL.md:14`: ```markdown 3. Install EdithAI CLI: `npm install -g @xin9min9/edithai-cli` ``` `README.md:15-18`: ```markdown 3. **Install EdithAI CLI**: ```bash npm install -g @xin9min9/edithai-cli ``` ``` ### Technical Analysis The project instructs users to install `@xin9min9/edithai-cli` from the npm registry without specifying an exact version or validating the package through a lockfile or integrity hash. The package is installed globally, but its source code is not included in the audited artifact. The audit therefore cannot verify its implementation, transitive dependencies, npm lifecycle scripts, or claimed security controls. Without an exact version constraint, the command resolves to whichever package release npm currently selects. A future malicious or compromised release could consequently be installed without any modification to this skill. npm packages may execute lifecycle scripts during installation, and the resulting CLI executes with the privileges of the installing or invoking user. The potential exposure is increased by the documented capabilities of the external CLI. It is expected to receive `DEEPSEEK_API_KEY`, read and write files, inspect logs, run diagnostic commands, examine processes and network connections, and retain conversation history. Although the documentation claims that command restrictions and path protections exist, those controls cannot be verified because the implementation is absent. This finding does not establish that the current npm package is malicious. It establishes that the documented installation process ...[truncated 2141 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Pin an exact reviewed version** Replace the floating installation command with an exact package version, for example: ```bash npm install --global --ignore-scripts @xin9min9/edithai-cli@<reviewed-version> ``` The selected version must be independently reviewed before publication of the skill. 2. **Verify package integrity** Record and verify the expected npm integrity digest or package tarball checksum. Automate verification in the installation process so installation fails if package contents change. 3. **Vendor or include the implementation** Include the executable source and dependency manifests in the audited artifact, or reference an immutable source commit and reproducible build instructions. This permits review of command execution, file access, API communication, and security controls. 4. **Avoid global installation** Prefer a project-local dependency with a committed lockfile, or execute the tool from a dedicated isolated environment. Do not recommend `sudo npm install -g`. 5. **Control lifecycle scripts** Use `--ignore-scripts` where package functionality permits. If lifecycle scripts are required, audit each script and all code it invokes before installation. 6. **Lock transitive dependencies** Commit a lockfile with integrity metadata and use a deterministic installation command such as `npm ci`. Continuously scan direct and transitive dependencies for compromise and known vulnerabilities. 7. **Apply runtime isolation** Run the CLI in a container or sandbox with: - Read-only access to explicitly selected log files. - No access to unrelated home-directory or system files. - A minimal environment containing only required credentials. - Restricted outbound network access limited to the expected API endpoint. - No administrative privileges. - Command execution disabled unless explicitly necessary. 8. **Reduce credential exposure** Use a narrowly scoped API ...[truncated 423 chars]