T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:10
- Finding
- Unpinned Third-Party Installation Commands Enable Supply-Chain Compromise## Vulnerability Details **File Location**: `SKILL.md`, lines 10-23 **Vulnerability Type**: Unpinned and mutable third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```bash # Install all skills from repo npx skills add https://github.com/barneyjm/camino-skills # Or install specific skills npx skills add https://github.com/barneyjm/camino-skills --skill parking-finder ``` ```bash npx clawhub@latest install parking-finder # or: pnpm dlx clawhub@latest install parking-finder # or: bunx clawhub@latest install parking-finder ``` ### Technical Analysis The documented installation workflow invokes npm-distributed package runners and retrieves Skill content from mutable third-party sources. The `clawhub@latest` reference explicitly resolves to whichever release is current at installation time. Similarly, the GitHub repository URL is not pinned to an immutable commit hash. As a result, the code or Skill content executed or installed by these commands can change after this audit without any modification to the reviewed project. Compromise of the relevant npm publisher account, package, GitHub account, repository, or default branch could introduce attacker-controlled content into the installation process. No evidence indicates that the currently reviewed dependencies are malicious. The vulnerability is the absence of version pinning and integrity controls in commands that users are instructed to execute. ### Attack Path 1. An attacker compromises a referenced npm publisher account, package release process, GitHub account, or repository. 2. The attacker publishes a malicious version under the tag resolved by `@latest`, or modifies the mutable GitHub repository content. 3. A user follows the installation instructions in `SKILL.md`. 4. `npx`, `pnpm dlx`, or `bunx` downloads and runs the dynamically resolved package, or the installer retrieves altered Skill content from the repository. 5. Malicious pac ...[truncated 851 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed package version rather than a floating distribution tag. 2. Pin GitHub installation sources to a specific immutable commit hash instead of the repository's mutable default branch. 3. Publish and verify cryptographic checksums or signatures for downloaded Skill artifacts. 4. Document the exact package versions and source commits that were security-reviewed. 5. Use lockfiles and package-manager integrity metadata where the installation workflow supports them. 6. Review package lifecycle scripts and minimize or disable installation-time script execution when feasible. 7. Update pinned versions only through a controlled process that includes source review, integrity verification, and security testing.