T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:32
- Finding
- Dependency Installation Without Cryptographic Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 32-45 **Vulnerability Type**: Unverified third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```markdown ## Installation ### NPM ```bash npm install -g @maton/cli@0.3.1 ``` ### Homebrew ```bash brew install maton-ai/cli/maton brew pin maton ``` Versions are pinned to the release this skill was reviewed against. Upgrade deliberately - check the release notes, then move the pin - rather than by re-running an unpinned install. Homebrew cannot select a version from a tap, so `brew pin maton` holds the installed build until you choose to upgrade; `maton-ai/cli` is Maton's own tap. ``` ### Technical Analysis The skill instructs the agent to install executable third-party packages directly from npm and a vendor-controlled Homebrew tap without verifying a cryptographic checksum, package signature, provenance attestation, or expected artifact digest. The npm package is version-pinned, which reduces accidental upgrades but does not independently establish artifact integrity. A compromised publisher account, registry, package artifact, or mutable registry response could still serve malicious content under the documented version. The Homebrew path is more exposed because `brew install maton-ai/cli/maton` resolves the formula available from the tap at installation time. The subsequent `brew pin maton` only prevents later upgrades; it does not pin or authenticate the version initially downloaded. Consequently, the installed build may differ from the release audited for this skill. The use of `npm install -g` increases impact because installation occurs globally and package lifecycle scripts may execute during installation. Although the project contains no evidence that these dependencies are currently malicious, the installation procedure lacks controls needed to ensure that reviewed code is the code ultimately executed. ### Attack Path 1. An attacker compromises ...[truncated 1635 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Publish trusted SHA-256 or stronger digests for every reviewed CLI artifact and verify the downloaded artifact before installation. 2. Use npm package provenance attestations and verify registry signatures or trusted publisher provenance in the installation workflow. 3. Prefer a lockfile-backed, local installation over `npm install -g` where feasible, and disable lifecycle scripts with `--ignore-scripts` unless they are explicitly required and reviewed. 4. Pin the Homebrew formula to an immutable commit or versioned formula corresponding exactly to the audited release. Do not rely on `brew pin` to authenticate the initially installed build. 5. Verify Homebrew bottle checksums and the trusted commit hash of the vendor tap before installation. 6. Document the exact expected package version, artifact digest, source repository commit, and verification commands in `SKILL.md`. 7. Run the CLI with minimum operating-system privileges and avoid installing it as root or with `sudo`. 8. Use an isolated environment or container with restricted filesystem and network access when dependency verification cannot be guaranteed. 9. Establish a release-review process that validates package contents, lifecycle scripts, transitive dependencies, and published provenance before updating documented versions. ]]>