Unpinned Tool Launch Dependency

What Foo Guard detects

An npx registry package declaration has no exact version. A local locked dependency may already determine resolution; this scan does not inspect the launcher environment, installed packages, or lockfiles.

When this rule triggers

The rule triggers when An npx registry package declaration has no exact version. A local locked dependency may already determine resolution; this scan does not inspect the launcher environment, installed packages, or lockfiles.

Foo Guard evaluates the normalized configuration supplied to the scanner. A finding describes configuration risk; it does not establish that an attack occurred. An absent finding does not prove that an undeclared capability is safe.

How to fix

Pin the reviewed package to an exact version, or verify and document resolution through a controlled lockfile and installation process. Review updates explicitly. Pinning alone does not establish package integrity or safety.

Pin the reviewed package to an exact version, or verify and document resolution through a controlled lockfile and installation process. Review updates explicitly. Pinning alone does not establish package integrity or safety.

Verify the change

Update the actual agent configuration and the underlying permissions or controls, then run the scanner again. Inspect the finding’s evidence path to confirm the intended setting changed. Do not clear a finding by changing a declaration that no longer reflects the deployed agent.

Test the affected workflow in an isolated environment, including an operation that should be denied. Keep related findings in view: fixing this rule does not automatically resolve other identity, permission, tool, or audit risks.