T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:111
- Finding
- Unpinned Third-Party Package Execution Through npx## Vulnerability Details **File Location**: `SKILL.md`, lines 111–127 **Vulnerability Type**: Unpinned executable dependency and mutable skill sources **Risk Level**: Medium ```bash # Full platform skill (all 150+ apps) npx skills add inference-sh/skills@infsh-cli # Pruna P-Image (fast & economical) npx skills add inference-sh/skills@p-image # FLUX-specific skill npx skills add inference-sh/skills@flux-image # Upscaling & enhancement npx skills add inference-sh/skills@image-upscaling # Background removal npx skills add inference-sh/skills@background-removal # Video generation npx skills add inference-sh/skills@ai-video-generation # AI avatars from images npx skills add inference-sh/skills@ai-avatar-video ``` ### Technical Analysis The documented commands invoke `npx skills` without pinning the `skills` package to a verified version or integrity hash. Depending on the local environment and cache state, `npx` can retrieve and execute package code from the configured npm registry when the command is invoked. The skill sources are also referenced without immutable commit identifiers or verified artifact hashes. Consequently, the content installed by these commands can change after this project has been reviewed. This creates a supply-chain trust boundary in which compromise of the npm package, package maintainer account, source repository, or referenced upstream content could introduce attacker-controlled installation logic or skill instructions. ### Attack Path 1. An attacker compromises the unpinned `skills` package, its publishing account, the referenced source repository, or another relevant upstream distribution channel. 2. The attacker publishes altered package code or modifies mutable skill content. 3. A user or agent follows one of the documented `npx skills add` commands. 4. `npx` retrieves and executes the available package version under the invoking user's account. 5. The package ...[truncated 850 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the `skills` npm package to a specific reviewed version rather than invoking an unspecified release, for example by using an exact version with lockfile enforcement. 2. Pin every referenced skill source to an immutable, reviewed commit or release artifact. 3. Verify package integrity through trusted checksums, registry integrity metadata, or cryptographic signatures before execution. 4. Prefer a download-and-review workflow that does not execute package lifecycle or installer code automatically. 5. Disable npm lifecycle scripts where they are unnecessary and supported by the installation workflow. 6. Execute installation in a restricted environment with minimal filesystem permissions, no unrelated credentials, and limited network access. 7. Maintain an allowlist of approved package versions, source commits, and hashes, and periodically audit them for ownership or integrity changes.