T08 · Insecure Dependencies
Error
- Location
SKILL.md:21- Finding
Unpinned Third-Party CLI and Unattended Global Skill Installation
- Content
View full analysis
` - Install a skill from GitHub or other sources - `npx skills check` - Check for skill updates - `npx skills update` - Update all installed skills ``` ```markdown If the user wants to proceed, you can install the skill for them: ```bash npx skills add -g -y ``` ``` ### Technical Analysis The skill directs the Agent to invoke `npx skills` without pinning the CLI to an exact, reviewed version. Depending on the local environment and npm cache, `npx` can retrieve and execute the current published version of the package. This creates a mutable remote dependency whose behavior may change after this skill has been reviewed. The installation workflow also permits packages discovered from GitHub or other external sources and recommends `-g -y`, which installs globally at the user level while suppressing confirmation prompts. The documented process does not require: - Pinning the CLI package to an exact version and integrity hash. - Pinning installed skills to immutable commit identifiers. - Restricting installation to an audited source allowlist. - Reviewing downloaded files before activation. - Verifying signatures, checksums, provenance, or publisher identity. - Obtaining explicit user confirmation immediately before installation. Consequently, compromise of the npm package, a referenced repository, or a similarly named dependency could introduce attacker-controlled code or instructions into the Agent environment. ### Attack Path 1. An attacker publishes a malicious or typosquatted skill, compromises a legitimate skill repository, or compromises the npm package resolved b ...[truncated 1520 chars]- Remediation
View remediation
find ``` Record and verify the package integrity hash through a lockfile or equivalent trusted mechanism. Do not use `--yes` for installation actions. 2. Require skills to be pinned to immutable commit hashes or signed releases rather than mutable repository branches or tags. 3. Establish an allowlist of reviewed publishers and repositories. Reject typosquatted names, unexpected forks, and sources without verifiable provenance. 4. Download candidate skills into an isolated temporary directory and inspect all instructions, scripts, manifests, lifecycle hooks, dependencies, and external network behavior before installation. 5. Verify checksums, signatures, publisher identity, and repository ownership. Re-run review whenever the pinned version or commit changes. 6. Remove `-y` from installation commands and require explicit, informed user approval after presenting the exact source, revision, requested installation scope, and review results. 7. Avoid `-g` by default. Prefer a task-local or isolated installation with minimum filesystem and network permissions. 8. Run discovery and installation tooling in a sandbox or container without sensitive environment variables, credentials, broad filesystem access, or elevated privileges. 9. Separate search from installation: search results must be treated as untrusted input and must never be installed automatically merely because they rank highly or use a familiar name. ]]>