T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:66
- Finding
- Execution of an Unpinned Third-Party Package Through npx## Vulnerability Details **File Location**: `SKILL.md`, line 66 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium **Vulnerable Code**: ```bash npx -y @alipay/agent-payment@latest install ``` ### Technical Analysis The optional installation instructions direct the agent to download and execute the `latest` release of a third-party npm package. The `latest` tag is mutable, so the code executed in the future may differ from the version available when this Skill was audited. The `-y` option also suppresses the normal package-installation confirmation. The surrounding instructions subsequently direct the agent to read and follow instructions from the newly installed `skillpay-onboarding` Skill. Those external instructions and their effective code are not included in this project and therefore are outside the reviewed trust boundary. This is a supply-chain risk rather than evidence that the package is currently malicious. The vulnerable path is optional and is not invoked by the bundled lesson-hour checking runtime. Nevertheless, compromise of the package, publisher account, npm distribution path, or mutable release tag could turn the documented installation procedure into arbitrary local code execution. ### Attack Path 1. An attacker compromises the npm package, its publisher account, or another part of its distribution chain. 2. The attacker publishes a malicious release and assigns it to the mutable `latest` tag. 3. A user or agent follows the installation instructions in `SKILL.md`. 4. `npx -y` retrieves the current malicious release without an interactive installation prompt. 5. npm package lifecycle or executable code runs with the permissions of the invoking user. 6. The agent may then load and follow additional attacker-controlled instructions from the installed Skill. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the privileges ...[truncated 529 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `@latest` with an explicitly reviewed and immutable package version. 2. Verify the downloaded package against a documented integrity digest or lockfile before execution. 3. Remove `-y` so users receive a confirmation opportunity before package execution. 4. Require explicit user approval immediately before running the installation command. 5. Document the expected npm publisher, package version, integrity value, and official registry source. 6. Inspect the installed Skill and its scripts before loading or following its instructions. 7. Prefer distributing reviewed installation logic within the audited package instead of dynamically executing mutable external code. 8. Run any unavoidable installer in a sandbox with minimal filesystem, credential, network, and process privileges.