T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:42
- Finding
- Unpinned Third-Party Packages and Skills Are Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 42-47, 66, 89, 108-120, and 134 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```markdown | `npx mp-skills new <name>` | 创建新项目骨架 | Step 2 | | `npx mp-skills add ... --skill <name>` | 安装 Skill | Step 3 | | `npx mp-skills add ... --all` | 安装全部 Skill | Step 3 备选 | | `npx mp-skills setup` | 初始化环境 | Step 4 引导 | | `npx mp-skills list` | 查看已安装 Skill | 用户要求查看时 | | `npx mp-skills validate <project-dir>` | 检查 Skill 质量 | 用户要求检查时 | 提示先安装：`npm install -g mp-skills` ``` ```bash npx mp-skills new <project-name> ``` ```bash npx mp-skills add TencentCloudBase/awesome-miniprogram-skills --skill greet-skill ``` ```bash npx mp-skills add TencentCloudBase/awesome-miniprogram-skills --skill <业务Skill名> ``` ```bash npx mp-skills add TencentCloudBase/awesome-miniprogram-skills --all ``` ```bash npx mp-skills setup ``` ### Technical Analysis The workflow instructs the agent to download and execute the `mp-skills` npm package without specifying an audited version or integrity value. Depending on the local npm and `npx` configuration, `npx mp-skills` can retrieve the package version currently resolved by the registry and execute its entry point. The workflow also installs content from `TencentCloudBase/awesome-miniprogram-skills` without pinning an immutable commit, release, or content digest. The `--all` alternative further increases the supply-chain attack surface by installing every available skill, including components that are not necessary for the requested project. No evidence establishes that the named package or repository is currently malicious. The weakness is that future or compromised upstream content could be executed without an immutable trust decision. ### Attack Path 1. An attacker compromises the npm package, its publisher account, the package registry resolution path, or the referenced skill repository. 2. The attacker publishes or inser ...[truncated 1218 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `mp-skills` to an explicitly audited version, for example: ```bash npx --yes mp-skills@<audited-version> new <validated-project-name> ``` 2. Record and verify the npm package integrity digest or signature before execution. 3. Prefer a project-local, lockfile-controlled dependency over `npm install -g`, reducing global environment exposure. 4. Pin `TencentCloudBase/awesome-miniprogram-skills` to an immutable commit or signed release rather than a mutable repository head. 5. Verify repository ownership, release signatures, and downloaded content before installation. 6. Remove the recommendation to install all skills with `--all`. Install only the minimum reviewed skills required for the requested functionality. 7. Run dependency installation and setup in a restricted development container or sandbox without unrelated credentials. 8. Add a mandatory review step before executing newly downloaded CLI versions, setup hooks, or skill scripts. ]]>