T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:276
- Finding
- Unpinned and Unattended Global Installation of Third-Party Skills<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:276-278` **Additional Locations**: `SKILL.md:141`, `SKILL.md:457-460`, `README.md:15-17`, `README.md:99-102`, `README_CN.md:17-19`, `README_CN.md:101-104` **Vulnerability Type**: Third-party supply-chain exposure through mutable, unverified dependencies **Risk Level**: Medium ### Vulnerable Code `SKILL.md:276-278`: ```yaml skills_to_install: - skill: "owner/repo@skill-name" command: "npx skills add owner/repo@skill-name -g -y" ``` `SKILL.md:457-460`: ```bash # Search the skills ecosystem npx skills find <query> # Install a discovered skill npx skills add <owner/repo@skill> -g -y ``` `README.md:15-17`: ```bash npx skills add https://github.com/clawdbot-skills/task-decomposer -g -y ``` `README.md:99-102`: ```bash # Search the skills ecosystem npx skills find <query> # Install a discovered skill npx skills add <owner/repo@skill> -g -y ``` ### Technical Analysis The Skill instructs agents or users to search a live third-party ecosystem and globally install discovered Skills using `npx` and the flags `-g -y`. Neither the Skills CLI nor the selected Skill is pinned to an immutable version or commit. The workflow also does not require checksum or signature verification, publisher validation, repository review, or an allowlist. Using `npx` can download and execute tooling that is not already installed locally. The generated installation command then retrieves mutable third-party Skill content. The `-y` flag suppresses interactive confirmation, while `-g` expands the installation scope beyond the current project or task. The documented evaluation criteria consider relevance, completeness, and documentation quality, but do not establish dependency provenance or integrity. The user-confirmation statement at `SKILL.md:470` applies to creating a new Skill, not to installing a discovered third-party Skill. No specific malicious dependency was identified during this audit, and the re ...[truncated 1839 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Pin the CLI and every installed Skill** - Use an explicit, trusted version of the Skills CLI. - Install Skills by immutable commit hash, cryptographic digest, or signed release rather than a mutable repository reference or branch. 2. **Require explicit installation approval** - Remove unattended `-y` behavior from generated commands. - Present the selected publisher, repository, version, requested capabilities, and review results before asking the user to approve installation. - Apply the existing user-confirmation requirement to both Skill creation and third-party installation. 3. **Avoid global installation by default** - Remove `-g` from the default command. - Install into an isolated, task-scoped directory or sandbox. - Ensure temporary dependencies are removed after the task completes. 4. **Review third-party content before installation** - Retrieve the candidate repository without executing its code. - Inspect all Skill instructions, scripts, lifecycle hooks, dependencies, symbolic links, and generated commands. - Reject packages containing unexpected network retrieval, credential access, persistence, destructive commands, or privilege escalation. 5. **Validate provenance and integrity** - Verify repository ownership, publisher identity, release signatures, checksums, and redirect destinations. - Maintain an allowlist of trusted publishers and repositories. - Detect ownership transfers, newly created publishers, typosquatting, and unexpected repository changes. 6. **Constrain installed Skills** - Run third-party Skills with least privilege and explicit tool permissions. - Restrict filesystem, network, credential, and command-execution access to what the current task requires. - Log installation decisions and dependency identities for later review. A safer generated command should use a reviewed immutable reference and a local scope, with installation occurring o ...[truncated 37 chars]