T08 · Insecure Dependencies
- Location
SKILL.md:7- Finding
Unpinned Third-Party Package Execution Through npx
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:7
Vulnerability Type: Insecure dependency resolution and execution
Risk Level: MediumVulnerable Code:
yaml allowed-tools: - Bash(firecrawl *) - Bash(npx firecrawl *)Technical Analysis
The skill authorizes execution of
npx firecrawlwithout specifying an audited package version or requiring installation through a dependency lockfile. If the package is not already available locally,npxcan resolve and download the current package release from the configured package registry before executing it.This makes the code executed by the skill mutable after the skill itself has been reviewed. A compromised package release, registry account, dependency, or package-resolution configuration could cause untrusted lifecycle or command-line code to execute locally. The audit found no evidence that the referenced Firecrawl package is currently malicious; the issue is the unsafe, unpinned execution mechanism.
Attack Path
- An attacker compromises the package, one of its transitive dependencies, its publishing account, or the package registry used by
npx. - The attacker publishes a malicious release that can be selected by unversioned package resolution.
- A user invokes the skill in an environment where
firecrawlis not securely installed and pinned. - The agent runs
npx firecrawl ...under the authorization granted bySKILL.md. npxresolves and downloads the mutable package release.- Malicious package lifecycle or CLI code executes with the operating-system permissions and environmental access of the agent process.
Impact Assessment
Successful exploitation could provide arbitrary code execution under the agent's user account. Depending on the runtime environment, the malicious package could read or modify files accessible to that account, access environment variables and locally available credentials, make outbound ...[truncated 290 chars]
- An attacker compromises the package, one of its transitive dependencies, its publishing account, or the package registry used by
- Remediation
View remediation
Remediation Suggestions
- Remove
Bash(npx firecrawl *)if the separately authorizedfirecrawlexecutable is sufficient. - Install Firecrawl through a reviewed dependency manifest and commit the corresponding lockfile.
- Pin the dependency to an exact audited version rather than resolving the latest available release.
- Enforce package integrity verification through lockfile integrity hashes and a trusted registry configuration.
- Install dependencies during a controlled build or provisioning phase rather than downloading and executing them when the skill is invoked.
- Disable package lifecycle scripts during installation where operationally feasible, and review required scripts before enabling them.
- Run the CLI in a least-privilege sandbox with restricted filesystem, credential, environment-variable, and outbound-network access.
- Periodically review the pinned package and its transitive dependencies for known vulnerabilities before performing controlled upgrades.
- Remove