T08 · Insecure Dependencies
Warning
- Location
- README.md:9
- Finding
- Unpinned npm Package and Mutable Repository Used in Installation Command## Vulnerability Details **File Location**: `README.md:9` **Vulnerability Type**: Unpinned third-party dependency and mutable remote source **Risk Level**: Medium **Vulnerable Code**: ```sh With the skills CLI: `npx skills add https://github.com/AntreasAntoniou/butler-agent-skill --skill butler`. This installer requires Node/network access; inspect the repository before installing. ``` ### Technical Analysis The documented installation command invokes `npx skills` without specifying an exact package version. If the package is not already installed locally, `npx` may retrieve and execute the package version currently resolved by the npm registry. The GitHub repository is also referenced without an immutable commit identifier or verified release artifact. Consequently, the effective installation code can change after this Skill version has been audited. Advising users to inspect the repository does not ensure that the npm package or repository revision executed during installation is identical to the reviewed version. This is a supply-chain weakness rather than evidence that the current bundled source is malicious. No malicious dependency, external payload, or compromise was identified in the audited artifact. ### Attack Path 1. An attacker compromises the npm package, maintainer account, registry publication process, GitHub account, or repository default branch. 2. The attacker publishes or commits a modified installer or Skill payload. 3. A user follows the documented unpinned `npx skills add` command. 4. `npx` resolves and executes the mutable package version, which retrieves the mutable repository revision. 5. The compromised installer or retrieved code executes or is installed with the invoking user's permissions. ### Impact Assessment A compromised installer could execute arbitrary code with the privileges of the user running `npx`. This could permit access to user-readable files, modification of the user's Ski ...[truncated 371 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the npm CLI package to an exact reviewed version, for example `npx skills@X.Y.Z`, and avoid floating tags such as `latest`. 2. Pin the GitHub source to an immutable, reviewed commit or cryptographically signed release rather than the repository's mutable default branch. 3. Publish SHA-256 checksums for release archives and instruct users to verify them before installation. 4. Prefer a package-lock-backed local installation or another mechanism that verifies dependency integrity before execution. 5. Provide a non-executing manual installation option that downloads a fixed release artifact for inspection before any scripts run. 6. Document the exact npm package version, repository commit, expected hashes, and signature-verification procedure used for each Skill release.