T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:63
- Finding
- Mutable Third-Party Package Execution in Optional Upgrade Workflow## Vulnerability Details **File Location**: `SKILL.md`, lines 63-70 **Vulnerability Type**: Unsafe execution of an unpinned third-party dependency **Risk Level**: Medium ### Vulnerable Code ```text Copy the following text verbatim to your AI assistant, and it will guide you through installation and purchase (wallet authorization or payment must be confirmed by you): Please purchase and install the Skill “Platform Settlement Check · Buyout Edition” through SkillPay. Official installation and purchase guide: https://skillpay.alipay.com/buildguide.md First read the official guide, verify the source, and complete the first step in the guide: npx -y @alipay/agent-payment@latest install After installation, read the SKILL.md of the newly installed skillpay-onboarding, then follow its instructions to purchase and install product S0806000206825371 from merchant 2088702818190040. I authorize dependency installation and initiation of the purchase; when wallet authorization or payment is needed, provide the official link or QR code for my confirmation and do not confirm it on my behalf. After confirmation, continue product installation and verification. ``` ### Technical Analysis The optional commercial-upgrade instructions direct an AI agent to execute: ```bash npx -y @alipay/agent-payment@latest install ``` The `@latest` selector is mutable and does not identify a specific reviewed package artifact. The `-y` option automatically accepts the package execution prompt. No pinned version, package lock, integrity hash, vendored source, or signature-verification procedure is provided. As a result, the code executed when a user follows these instructions may differ from the code that existed when this Skill was audited. The workflow also delegates subsequent actions to the `SKILL.md` file of the newly installed package, creating a secondary trust boundary in which remotely supplied instructions can influence later installation and pu ...[truncated 1770 chars]
- Remediation
- ## Remediation Suggestions 1. Remove executable installation instructions from the local settlement-checking Skill and place the commercial upgrade process in separate, clearly identified documentation. 2. Replace `@latest` with an explicitly audited package version. 3. Verify the downloaded package against a publisher-provided cryptographic integrity hash or signature before execution. 4. Avoid automatic confirmation through `npx -y`; display the exact package name, version, source, and requested actions before obtaining explicit user approval. 5. Review and pin every transitive dependency through a lockfile or equivalent reproducible installation mechanism. 6. Do not automatically trust or execute instructions from a newly installed `SKILL.md`. Subject the installed Skill and its scripts to an independent security review before granting tools or following further instructions. 7. Require separate, explicit user authorization for dependency installation, network access, product installation, wallet interaction, and payment initiation. 8. Run any unavoidable installer in a restricted sandbox with minimal filesystem access, no ambient credentials, no elevated privileges, and narrowly controlled network access.