T08 · Insecure Dependencies
Warning
- Location
- README.md:17
- Finding
- Unpinned Third-Party Installer Executes Mutable Remote Content## Vulnerability Details **File Location**: `README.md`, lines 17–24 **Vulnerability Type**: Unpinned dependency execution and mutable remote installation **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add anivar/jest-skill -g ``` ```bash npx skills add https://github.com/anivar/jest-skill ``` ### Technical Analysis The installation instructions invoke `npx skills` without pinning the `skills` package to a reviewed version or verifying its integrity. Depending on the local environment and `npx` behavior, this can download and execute the currently published package under the invoking user's account. The second command additionally installs Skill content from a mutable GitHub repository reference without pinning it to an immutable commit. Consequently, the effective installer and installed Skill content can differ from the versions covered by this audit. The global installation flag in the first command increases scope by making the installed Skill available beyond one project. This does not demonstrate that the current package is malicious, but it creates a supply-chain trust boundary that is not constrained by version or integrity controls. ### Attack Path 1. An attacker compromises the npm package used by `npx skills`, its publisher account, or a transitive dependency. 2. Alternatively, the attacker compromises the referenced GitHub repository or its maintainer account. 3. The attacker publishes a malicious package version or changes the repository's mutable default branch. 4. A user follows one of the documented installation commands. 5. `npx` retrieves and executes the unpinned installer under the user's privileges. 6. The installer retrieves mutable Skill content and, with the global form, installs it into a cross-project location. 7. Malicious installer code could access resources available to the invoking user, while malicious Skill instructions could affect later agent sessions in which the globally installed Skill is loaded. ...[truncated 867 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the `skills` installer to a specifically reviewed version rather than invoking the mutable latest release: ```bash npx --yes skills@<audited-version> add ... ``` 2. Pin repository installation to an immutable commit SHA or cryptographically verified release tag where the installer supports it. 3. Publish expected commit identifiers or checksums and instruct users to verify downloaded content before installation. 4. Avoid global installation by default. Recommend project-scoped installation and document the additional trust implications of `-g` separately. 5. Use lockfiles, provenance attestations, signed releases, and registry integrity metadata for the installer and its transitive dependencies. 6. In security-sensitive environments, require users to download and inspect the pinned installer and Skill content before executing or enabling them. 7. Add an explicit warning that `npx` can download and execute packages and that repository URLs without commit pins may resolve to content different from the audited revision.