T08 · Insecure Dependencies
- Location
SKILL.md:358- Finding
Unpinned Remote Skill Installation Creates a Supply-Chain Execution Risk
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 358-362
Vulnerability Type: Unpinned third-party package and remote skill installation
Risk Level: MediumVulnerable Code
bash skills.sh install script: npx skills add AgentPMT/agent-skills --skill what-is-agentpmt npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setupTechnical Analysis
The documented installation commands use
npx skillswithout specifying an exact package version and retrieve skills fromAgentPMT/agent-skillswithout pinning a commit SHA or immutable release. Consequently, the code installed and executed can differ from the content that was reviewed during this audit.If the npm package, package publisher, source repository, or upstream account is compromised, a later invocation could retrieve attacker-controlled content. Depending on the behavior of the
skillsinstaller and the downloaded skills, this may involve package lifecycle scripts, installer code, or malicious skill instructions.These commands are documentation rather than automatically executed code, so exploitation requires a user or agent to follow the installation instructions. This reduces immediacy but does not eliminate the supply-chain risk.
The separately flagged network behavior—using AgentPMT-hosted calls to access GitHub repositories—is consistent with the declared remote repository-browser functionality. The reviewed files instruct users not to expose account secrets and do not contain explicit credential-exfiltration logic. However, private repository content and metadata are necessarily processed through the AgentPMT service, so users must trust that service and should grant the connected GitHub token only the minimum read permissions required.
Attack Path
- An attacker compromises the npm package resolved by
npx skills, its publisher account, theAgentPMT/agent-skillsrepository, or an upstream distribu ...[truncated 1477 chars]
- An attacker compromises the npm package resolved by
- Remediation
View remediation
Remediation Suggestions
-
Pin the
skillsnpm package to an exact, reviewed version instead of allowingnpxto resolve the latest release:bash npx --yes skills@<exact-reviewed-version> add AgentPMT/agent-skills --skill what-is-agentpmt -
Pin
AgentPMT/agent-skillsto an immutable commit SHA or cryptographically verified release tag if the installer supports repository references:bash npx --yes skills@<exact-reviewed-version> add AgentPMT/agent-skills@<full-commit-sha> --skill what-is-agentpmt -
Publish and verify checksums or signed provenance for downloaded skill artifacts. Fail installation if the digest or signature does not match the reviewed release.
-
Use npm lockfiles and integrity metadata where applicable, and configure npm to use an approved registry.
-
Avoid executing package lifecycle scripts unless they are explicitly required and reviewed. Run installation in a sandbox with restricted filesystem, environment, and network access.
-
Document the exact expected publisher, version, commit SHA, and artifact digest so users can independently verify the dependency.
-
Apply least privilege to the connected GitHub token. Prefer fine-grained, read-only access limited to explicitly selected repositories rather than account-wide private-repository access.
-
Require explicit user confirmation before transmitting private repository content to AgentPMT storage or generating signed download URLs, and document retention, access-control, and deletion policies for stored repository data.
-