T08 · Insecure Dependencies
Warning
- Location
- README.md:21
- Finding
- Unpinned Third-Party Installer and Skill Source## Vulnerability Details **File Location**: `README.md:21` **Vulnerability Type**: Supply-chain risk from unpinned third-party dependencies **Risk Level**: Medium **Complete Code Snippet**: ```sh npx skills add AntreasAntoniou/ml-run-provenance --skill ml-run-provenance ``` ### Technical Analysis The installation command invokes the `skills` npm package through `npx` without specifying a reviewed package version or integrity hash. Depending on local npm behavior and cache state, `npx` can retrieve and execute a mutable package release from the npm registry. The command also identifies the Skill repository by owner and repository name rather than by a verified immutable commit. Consequently, the components executed or installed at installation time may differ from those reviewed during this audit. This is a supply-chain weakness rather than evidence that the currently audited validator is malicious. The bundled `scripts/validate_metadata.py` itself uses only the Python standard library and contains no remote retrieval or command-execution behavior. ### Attack Path 1. An attacker compromises the npm package, its publisher account, or another relevant distribution component. 2. The attacker publishes a malicious release under the package name used by the unversioned `npx` command. 3. A user follows the documented installation command. 4. `npx` retrieves the mutable malicious release and executes its installer logic under the invoking user's account. 5. The malicious installer can access or modify resources available to that user and can install altered Skill content. 6. Alternatively, compromise of the referenced Skill repository could cause the installer to retrieve content different from the audited revision. ### Impact Assessment Successful exploitation could execute attacker-controlled code with the privileges of the user running the installation command. The accessible scope could include that user's files, env ...[truncated 436 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the installer package to a specifically reviewed version rather than invoking an unqualified package name. 2. Use npm lockfile and integrity metadata where the installation workflow supports them. 3. Pin the Skill source to a verified immutable commit hash or signed release rather than a mutable repository reference. 4. Document how users can verify the package checksum, release signature, repository commit, and expected publisher identity before installation. 5. Prefer a download-and-review workflow that separates retrieval from execution for security-sensitive environments. 6. Recommend running installation with the least-privileged account possible and without unnecessary secrets in the process environment. 7. Establish a release process with protected publisher accounts, multi-factor authentication, signed tags, and reproducible release artifacts.