T08 · Insecure Dependencies
Warning
- Location
- README.md:39
- Finding
- Unpinned npx Installer and Mutable Skill Source## Vulnerability Details **File Location**: `README.md`, line 39 **Vulnerability Type**: Supply-chain risk caused by unpinned executable dependencies and a mutable source reference **Risk Level**: Medium **Complete Code Snippet**: ```markdown 1. Install the skill: `npx skills add AntreasAntoniou/visual-qa`. ``` ### Technical Analysis The documented installation command invokes the `skills` npm package through `npx` without specifying an exact package version or integrity value. Depending on the local npm environment and cache state, `npx` may download and execute the package version currently selected by the registry. The `AntreasAntoniou/visual-qa` source reference is also not pinned to an immutable commit, signed release, or verified artifact digest. Consequently, the installer implementation and the Skill content installed by this command can differ from the versions reviewed during this audit. This is a supply-chain weakness rather than evidence that the current dependency is malicious. Exploitation requires compromise, malicious publication, or unauthorized modification of one of the mutable upstream components. ### Attack Path 1. An attacker compromises the npm account, package publication process, registry resolution path, or repository used by the installation workflow. 2. The attacker publishes a modified `skills` package or changes the mutable Skill source referenced by `AntreasAntoniou/visual-qa`. 3. A user follows the documented unpinned `npx` command. 4. `npx` resolves and executes the attacker-controlled package version, or the installer retrieves attacker-controlled Skill content. 5. Malicious installer code executes with the privileges of the invoking user, or malicious Skill instructions become active in subsequent agent sessions. ### Impact Assessment Successful compromise of the executable npm dependency could allow arbitrary code execution with the permissions of the user running the installatio ...[truncated 485 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the `skills` CLI to an exact reviewed version, for example by using an exact npm version rather than an unversioned package name. 2. Pin the Skill source to an immutable commit hash or a cryptographically signed release instead of a mutable repository reference. 3. Publish and verify integrity hashes or signatures for released Skill artifacts. 4. Use a lockfile or an equivalent dependency-locking mechanism where the installation workflow supports one. 5. Configure CI to verify package provenance, release signatures, and expected artifact digests. 6. Document that users should inspect the resolved package and Skill content before granting execution or agent tool permissions. 7. Run installation with least privilege in an isolated environment, without production credentials or unnecessary filesystem access.