T08 · Insecure Dependencies
Error
- Location
SKILL.md:45- Finding
Unpinned Global Installation of an Unaudited Third-Party CLI Package
- Content
View full analysis
- Remediation
View remediation
``` The selected version must be independently reviewed before publication of the skill. 2. **Verify package integrity** Record and verify the expected npm integrity digest or package tarball checksum. Automate verification in the installation process so installation fails if package contents change. 3. **Vendor or include the implementation** Include the executable source and dependency manifests in the audited artifact, or reference an immutable source commit and reproducible build instructions. This permits review of command execution, file access, API communication, and security controls. 4. **Avoid global installation** Prefer a project-local dependency with a committed lockfile, or execute the tool from a dedicated isolated environment. Do not recommend `sudo npm install -g`. 5. **Control lifecycle scripts** Use `--ignore-scripts` where package functionality permits. If lifecycle scripts are required, audit each script and all code it invokes before installation. 6. **Lock transitive dependencies** Commit a lockfile with integrity metadata and use a deterministic installation command such as `npm ci`. Continuously scan direct and transitive dependencies for compromise and known vulnerabilities. 7. **Apply runtime isolation** Run the CLI in a container or sandbox with: - Read-only access to explicitly selected log files. - No access to unrelated home-directory or system files. - A minimal environment containing only required credentials. - Restricted outbound network access limited to the expected API endpoint. - No administrative privileges. - Command execution disabled unless explicitly necessary. 8. **Reduce credential exposure** Use a narrowly scoped API ...[truncated 423 chars]