T08 · Insecure Dependencies
Warning
- Location
SKILL.md:103- Finding
Automatic Execution of Unreviewed Project Dependencies
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 103–117
Vulnerability Type: Insecure dependency installation and build execution
Risk Level: Mediumbash ### 3. Run Project Setup Auto-detect and run appropriate setup: ```bash # Node.js if [ -f package.json ]; then npm install; fi # Rust if [ -f Cargo.toml ]; then cargo build; fi # Python if [ -f requirements.txt ]; then pip install -r requirements.txt; fi if [ -f pyproject.toml ]; then poetry install; fi # Go if [ -f go.mod ]; then go mod download; fitext ### Technical Analysis The skill directs the agent to install dependencies or compile a project solely based on the presence of common manifest files. It does not require user confirmation, dependency review, lockfile enforcement, integrity verification, lifecycle-script suppression, or sandboxing. In particular, `npm install` can execute package lifecycle scripts. Build and installation operations may also process attacker-controlled project configuration or dependency code. Python package installation can execute build backends, while Rust compilation can execute build scripts. Consequently, opening an untrusted repository and invoking this skill may cause code outside the reviewed skill package to execute with the agent process's permissions. This finding does not demonstrate that the skill itself contains a malicious dependency. The risk arises from automatically trusting and executing dependencies declared by whichever project invokes the skill. ### Attack Path 1. An attacker supplies or compromises a repository containing a supported manifest such as `package.json`, `Cargo.toml`, `requirements.txt`, or `pyproject.toml`. 2. The manifest references a malicious or compromised dependency, or the project contains installation/build configuration that causes attacker-controlled code to run. 3. A user or agent invokes this worktree skill for that repository. 4. The skill creates the isolated worktree and automatically run ...[truncated 1052 chars]- Remediation
View remediation
Remediation Suggestions
- Require explicit user approval before running any dependency installation, compilation, build script, or test command in an untrusted repository.
- Display the exact command, manifest, lockfile status, and intended network access before execution.
- Prefer reproducible, lockfile-enforcing commands where supported:
- Use
npm ciwith a committed lockfile instead of unconstrainednpm install. - Use
cargo build --locked. - Require pinned and hash-verified Python dependencies, such as
pip install --require-hashes -r requirements.txt. - Use locked Poetry installation and fail if the lockfile is missing or inconsistent.
- Use
- Disable package lifecycle scripts when they are unnecessary, for example by initially using
npm ci --ignore-scripts, and require separate approval before enabling them. - Run setup and tests in a sandbox or disposable container with least privilege, restricted filesystem mounts, no inherited secrets, and network access disabled or allowlisted.
- Avoid exposing SSH agents, cloud credentials, package registry tokens, or unrelated repository data to dependency-installation processes.
- Review manifests, lockfiles, source registries, and build hooks before execution. Fail closed when dependencies are unlocked, fetched from untrusted sources, or use unexpected Git/URL references.
- Separate dependency download from code-executing build phases so each operation can be reviewed and authorized independently.