T08 · Insecure Dependencies
Warning
- Location
- README.md:19
- Finding
- Unpinned npx Package Execution in Installation Instructions## Vulnerability Details **File Location**: `README.md:19-23` **Vulnerability Type**: Supply-chain exposure through execution of an unpinned package **Risk Level**: Medium **Vulnerable Code**: ```sh With the Agent Skills CLI: npx skills add AntreasAntoniou/back-to-the-chronicle --skill back-to-the-chronicle ``` ### Technical Analysis The documented installation command invokes the `skills` package through `npx` without specifying an immutable version or integrity constraint. If the package is not already available locally, `npx` can retrieve and execute its current published version. Consequently, the code executed during installation may differ from the code reviewed during this audit. This is a supply-chain trust issue rather than evidence that the package is currently malicious. A compromised package release, maintainer account, or transitive dependency could introduce arbitrary executable behavior. ### Attack Path 1. An attacker compromises the upstream `skills` package, its publishing account, or a dependency used by a subsequently published release. 2. The attacker publishes a malicious version under the same expected package identity. 3. A user follows the documented unversioned `npx skills add ...` command. 4. `npx` retrieves the mutable current release and executes it. 5. Malicious package code runs with the privileges and environment of the installing user. ### Impact Assessment Successful exploitation could execute arbitrary code with the installing user's privileges. Depending on the host environment, this could expose files accessible to that user, agent configuration, environment variables, project data, session stores, and credentials. It could also modify the user's Skill installation or other user-writable files. The command does not request administrator privileges, so its direct scope is normally limited to the invoking user's permissions. No evidence was found that the audited project itself p ...[truncated 20 chars]
- Remediation
- ## Remediation Suggestions - Pin the Agent Skills CLI to a specifically reviewed version, such as `npx skills@<reviewed-version> ...`. - Use an exact version rather than a mutable range or distribution tag. - Document the expected package publisher and package registry. - Where supported, verify the downloaded package against a published integrity hash, lockfile, signature, or provenance attestation. - Recommend downloading and inspecting the package before execution in sensitive environments. - Run installation with the minimum necessary user privileges and without unrelated secrets in the process environment.