T08 · Insecure Dependencies
Warning
- Location
SKILL.md:36- Finding
Unpinned Third-Party Package Execution and Non-Interactive Global Skill Installation
- Content
View full analysis
npx skills add -g -y ``` `SKILL.md`, line 75: ```bash npx skills init [new-skill-name] ``` ### Technical Analysis The documented workflow instructs the agent to invoke third-party command-line packages through `npx` without pinning exact package versions or verifying package integrity. If a requested package is not already available locally, `npx` can retrieve and execute it from the configured package registry. The installation workflow also recommends `npx skills add` with both the global installation flag (`-g`) and automatic confirmation flag (`-y`). This combination can install third-party skill content persistently in the user's environment without an interactive confirmation step. The instructions do not require cryptographic signature verification, checksum validation, publisher allowlisting, package-lock validation, or review of lifecycle scripts. The document advises users to read the downloaded `SKILL.md`, verify prerequisites, and test in isolation. These are useful procedural precautions, but they do not technically prevent execution of a compromised CLI package, malicious lifecycle script, dependency-confusion package, typosquatted package, or compromised skill repository. ### Attack Path 1. An attacker publishes a typosquatted package or skill, compromises a legitimate package or repository, or injects a malicious transitive dependency. 2. The malicious item is returned by a registry search or is supplied as the requested package or skill identifier. 3. The agent or user executes an unpinned `npx` command, causing the cur ...[truncated 1232 chars]- Remediation
View remediation