T08 · Insecure Dependencies
Warning
- Location
SKILL.md:33- Finding
Unpinned Third-Party Skill Installer and Mutable Remote Dependencies
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 33–38
Vulnerability Type: Unpinned third-party dependencies and unsafe remote installation
Risk Level: MediumVulnerable Code Snippet:
markdown skills.sh install script: ```bash npx skills add AgentPMT/agent-skills --skill what-is-agentpmt npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setuptext ### Technical Analysis The setup instructions invoke the `skills` npm package through `npx` without specifying an audited package version. They also install skills from `AgentPMT/agent-skills` without pinning the source to an immutable commit, signed release, or verified artifact checksum. Because both dependency references are mutable, the components executed or installed at deployment time may differ from those reviewed during this audit. The same unpinned installation pattern is repeated for other workflow dependencies later in `SKILL.md`. An attacker who compromises the npm package, its maintainer account, the remote skill repository, or the corresponding distribution infrastructure could publish altered installer behavior or malicious skill instructions. A dependency-confusion or package-takeover event could similarly cause `npx` to resolve and execute an untrusted package. ### Attack Path 1. An attacker compromises or takes control of the unversioned `skills` npm package, the `AgentPMT/agent-skills` repository, or an associated publishing account. 2. The attacker publishes a malicious package version or modifies one of the remotely hosted skills. 3. A user follows the documented setup procedure and runs the unpinned `npx skills add` command. 4. `npx` resolves and executes the currently published package rather than a previously audited version. 5. The installer retrieves mutable skill content from the remote repository. 6. The malicious dependency may execute with the invoking user's privileges or install ...[truncated 901 chars]- Remediation
View remediation
Remediation Suggestions
- Pin the npm CLI to a specific audited version, for example by using an exact version rather than an unqualified
npx skillsinvocation. - Pin
AgentPMT/agent-skillsto an immutable commit hash or cryptographically signed release instead of relying on the repository's current default branch. - Record and verify cryptographic checksums or signatures for every installed skill artifact.
- Use
npx --no-installwith a locally installed, lockfile-controlled dependency where feasible, preventing silent retrieval of an unexpected package. - Commit a package lockfile and use a deterministic installation command such as
npm ciwhen an npm project is involved. - Vendor and review the required skill definitions when operationally practical.
- Restrict installation to a sandboxed, least-privileged environment without production credentials or sensitive mounted directories.
- Review installed skills before granting access to Plaud, Google Sheets, Google Docs, or other authenticated integrations.
- Replace the instruction to reinstall automatically when content becomes stale with a controlled update process that performs signature verification, change review, and approval before installation.
- Pin the npm CLI to a specific audited version, for example by using an exact version rather than an unqualified