T08 · Insecure Dependencies
Warning
- Location
- README.md:25
- Finding
- Unpinned npx Installer and Mutable Skill Source<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, lines 25–28 **Vulnerability Type**: Unpinned third-party dependency and remote installation source **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add AntreasAntoniou/gcp-keyless ``` ### Technical Analysis The documented installation command invokes the `skills` npm package through `npx` without specifying a version. If the package is not already cached, `npx` can retrieve and execute the currently published package version. The referenced skill source is also identified by repository name without an immutable Git commit or release digest. Consequently, the code executed or installed can change after this repository has been audited. Compromise of the npm package, its publishing account, the referenced repository, or its default branch could introduce code that was not present during review. This behavior is not automatically triggered by the audited scripts and requires a user or agent to execute the installation command. Nevertheless, it creates a supply-chain execution path in an installation procedure likely to run with the invoking user's privileges. ### Attack Path 1. An attacker compromises the npm package used by `npx`, its publisher account, or the mutable source repository. 2. The attacker publishes a malicious package version or modifies the repository's default branch. 3. A user or agent follows the README and executes: ```bash npx skills add AntreasAntoniou/gcp-keyless ``` 4. `npx` retrieves and executes the mutable installer package, which then retrieves the mutable skill source. 5. Malicious installation code executes with the privileges and environment of the invoking user. ### Impact Assessment Successful exploitation could permit arbitrary code execution under the account running the installation command. Depending on the execution environment, this could expose local files, environment variables, GitHub credentials, active `gcloud` credentials ...[truncated 454 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the `skills` npm package to a reviewed exact version: ```bash npx --yes skills@X.Y.Z add AntreasAntoniou/gcp-keyless ``` 2. Pin the skill source to an immutable Git commit SHA or a release artifact with a published checksum rather than a mutable repository default branch. 3. Prefer a lockfile-backed installation process using `npm ci` so dependency resolution is reproducible and integrity values are checked. 4. Verify npm provenance, package ownership, and release signatures before updating the pinned installer version. 5. Document the exact reviewed installer version, source commit, and expected artifact checksum. 6. Perform installation in a sandbox without cloud credentials, GitHub tokens, SSH keys, or unrelated sensitive files. 7. Review dependency changes before updating either the installer version or the pinned skill revision. ]]>