T08 · Insecure Dependencies
Warning
- Location
SKILL.md:24- Finding
Unpinned Third-Party CLI Execution and Unscreened Global Skill Installation
- Content
View full analysis
` - Install a skill from GitHub or other sources - `npx skills check` - Check for skill updates - `npx skills update` - Update all installed skills ``` ```markdown Run the find command with a relevant query: ```bash npx skills find [query] ``` ``` ```markdown If the user wants to proceed, you can install the skill for them: ```bash npx skills add -g -y ``` The `-g` flag installs globally (user-level) and `-y` skips confirmation prompts. ``` ### Technical Analysis The Skill instructs the Agent to execute `npx skills` without pinning the npm package to an exact, reviewed version or enforcing an integrity hash. Depending on local npm behavior and cache state, `npx` can retrieve and execute a mutable package release from the npm registry. The workflow subsequently allows Skills to be selected from search results and installed from GitHub or other sources. It does not require verification of repository ownership, source inspection, an immutable commit reference, or package integrity before installation. The recommended `-g -y` options increase the risk because they install the selected Skill at user scope and suppress the normal confirmation prompt. This is a supply-chain weakness rather than evidence that the currently documented `skills` package or any particular repository is malicious. Exploitation depends on compromise or malicious control of the CLI package, registry/search results, or a selected Skill repository. ### Attack Path 1. An attacker publishes, takes control of, or compromises a relevant npm package release, Skill repository, or source surfaced by the search mechanism. 2. The Agent fo ...[truncated 1209 chars]- Remediation
View remediation
`, and enforce package-lock or integrity verification where supported. 2. Do not automatically trust search results. Restrict installations to an allowlist of reviewed owners, repositories, and Skill identifiers. 3. Pin installed Skills to immutable commit hashes or cryptographically verified releases rather than mutable branches or tags. 4. Require source review before installation, including inspection of Skill instructions, scripts, hooks, dependencies, and requested permissions. 5. Remove `-y` so users receive an explicit confirmation prompt before installation. 6. Default to project-local or isolated installation instead of `-g`. Require separate, informed consent when global installation is genuinely necessary. 7. Present the exact source, version or commit, installation scope, and security implications to the user before executing the command. 8. Run third-party package discovery and installation with least privilege, preferably in a sandbox without access to sensitive credentials or user files. 9. Add a post-installation verification process that confirms installed files match the reviewed source and reports unexpected executable components or hooks. ]]>