T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:477
- Finding
- Unpinned Third-Party Package Download and Execution## Vulnerability Details **File Location**: `SKILL.md`, line 477 **Vulnerability Type**: Supply-chain risk through an unpinned npm package **Risk Level**: Medium ### Vulnerable Code ```bash npx molthub@latest install skill-name ``` ### Technical Analysis The Skill instructs the agent to use `npx` with the mutable `@latest` tag. If the package is not already cached locally, `npx` may retrieve it from the configured npm registry and immediately execute its CLI code. The command does not pin an audited version, verify package integrity or provenance, validate the publisher, or require execution in a sandbox. Because `latest` can point to different package contents after this Skill has been reviewed, the effective executable payload is not fixed. A compromised maintainer account, registry compromise, malicious package update, or package ownership transfer could therefore introduce arbitrary code without any change to this repository. Installing another Skill is not necessary when the reviewer is given an existing local folder. Consequently, automatic third-party package execution exceeds the minimum privileges required for the declared static review functionality. ### Attack Path 1. An attacker compromises the `molthub` package, its publisher account, or the package release process. 2. The attacker publishes a malicious version and causes the npm `latest` tag to resolve to it. 3. A user asks the Skill to review another Skill that is not already available locally. 4. The agent follows the documented workflow and executes: ```bash npx molthub@latest install skill-name ``` 5. `npx` downloads and runs the remotely supplied package code. 6. The malicious code executes with the operating-system privileges and environment available to the agent process. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the invoking user's account. Depending on the runtime environment, the package could read or modify project file ...[truncated 362 chars]
- Remediation
- ## Remediation Suggestions 1. Remove automatic installation from the review workflow. Require users to supply a local Skill folder or archive for static inspection. 2. If package use is essential, pin a specifically reviewed version rather than using `@latest`, for example `molthub@X.Y.Z`. 3. Verify the package name, publisher, provenance, lockfile metadata, and registry integrity hash before execution. 4. Download and inspect the package separately before running any code. Do not combine retrieval and execution in one command. 5. Disable dependency lifecycle scripts where supported and applicable. 6. Run the tool inside a disposable sandbox or container with: - No host credentials or secrets - Read-only access to source material where practical - A dedicated temporary output directory - Restricted network access - No access to SSH agents, home-directory credentials, or unrelated repositories 7. Document the network and execution requirement explicitly in Skill compatibility metadata if this behavior is retained.