T08 · Insecure Dependencies
Warning
- Location
- README.md:22
- Finding
- Unpinned npx Installer Creates a Mutable Supply-Chain Execution Path## Vulnerability Details **File Location**: `README.md:22` **Vulnerability Type**: Unpinned third-party installer dependency **Risk Level**: Medium ### Vulnerable Code ```sh npx skills add AntreasAntoniou/doppel-gang --skill doppel-gang ``` ### Technical Analysis The documented installation command invokes the third-party `skills` npm package through `npx` without specifying an audited package version. It also identifies the Skill repository without pinning the installed content to an immutable commit. When the command is run, npm may resolve and execute the package version currently selected by the registry. The effective installer code can therefore differ from the version reviewed when this documentation was published. Likewise, mutable upstream repository content may differ from the audited project snapshot. This is a supply-chain exposure in the documented installation process rather than malicious behavior in the bundled Python helper. The reviewed `scripts/review_packet.py` implementation contains no network access, dynamic code execution, credential access, persistence, or subprocess invocation. ### Attack Path 1. An attacker compromises the npm package, its publisher account, its dependency chain, or the upstream Skill repository. 2. The attacker publishes altered installer logic or modifies the repository content resolved by the installation command. 3. A user follows the documented unpinned `npx` command. 4. `npx` downloads and executes the currently resolved package under the user's account. 5. Malicious installer logic can act with that user's filesystem and process privileges, or install altered Skill instructions that affect later agent sessions. Exploitation requires the user to run the documented installation command and requires compromise or malicious alteration of an upstream component. ### Impact Assessment The immediate execution scope is generally limited to the privileges of the user runn ...[truncated 529 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the installer CLI to a specific audited version, for example by using an explicit `package@version` reference supported by the selected CLI. 2. Pin Skill source content to an immutable commit hash or cryptographically signed release rather than relying only on a mutable repository name or branch. 3. Publish expected archive or file checksums and document how users can verify them before installation. 4. Prefer package-manager lockfiles, integrity metadata, and provenance attestations where applicable. 5. Document that `npx` executes downloaded code and recommend reviewing the resolved package and source before running the command. 6. For higher-assurance environments, provide a manual installation procedure that downloads a specific release, verifies its signature or checksum, and copies only the reviewed files.