T08 · Insecure Dependencies
Error
- Location
- SKILL.md:27
- Finding
- Unpinned Third-Party Package Execution and Global Skill Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 27–34 and 80–86 **Vulnerability Type**: Unpinned dependency execution and installation from insufficiently validated external sources **Risk Level**: High ### Vulnerable Code Snippets `SKILL.md`, lines 27–34: ```markdown **Key commands:** - `npx skills find [query]` - Search for skills interactively or by keyword - `npx skills add <package>` - Install a skill from GitHub or other sources - `npx skills check` - Check for skill updates - `npx skills update` - Update all installed skills **Browse skills at:** https://skills.sh/ ``` `SKILL.md`, lines 80–86: ```markdown ### Step 4: Offer to Install If the user wants to proceed, you can install the skill for them: ```bash npx skills add <owner/repo@skill> -g -y ``` ``` ### Technical Analysis The skill instructs the agent to invoke `npx skills` without pinning the CLI package to a reviewed version or enforcing an integrity hash. Depending on the local npm configuration and cache state, `npx` may download and execute the package resolved from the configured registry at invocation time. The effective executable can therefore differ from the version originally reviewed. The workflow also permits installation of skills from GitHub or unspecified “other sources.” It does not require verification of repository ownership, immutable commit identifiers, release signatures, checksums, package contents, or an approved-source allowlist. Search results may therefore introduce compromised, replaced, typo-squatted, or intentionally malicious packages. The recommended installation command combines `-g`, which installs the skill at user scope, with `-y`, which suppresses confirmation prompts. This reduces the opportunity for the user to inspect package provenance and contents before installation. A malicious installed skill could subsequently influence agent behavior or execute instructions whenever that skill is loaded. ### Attack Path 1. An attack ...[truncated 1861 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the Skills CLI to an explicitly reviewed version rather than invoking an unversioned package: ```bash npx --yes skills@<reviewed-version> find <query> ``` Prefer a lockfile-controlled local dependency and verify the package with an approved integrity hash. 2. Restrict installations to an explicit allowlist of trusted owners and repositories. Do not permit arbitrary “other sources” by default. 3. Pin every installed skill to an immutable commit SHA or cryptographically verified release rather than a mutable branch, tag, or search-result alias. 4. Remove `-y` from the default installation workflow. Before installation, display the resolved repository URL, owner, exact commit, package version, requested installation scope, and integrity information, then require explicit user confirmation. 5. Avoid `-g` by default. Install into a project-scoped or isolated directory with least privilege so that an untrusted skill cannot automatically affect unrelated projects or future sessions. 6. Download and inspect package contents before activation. Review instruction files, scripts, lifecycle hooks, executable files, symbolic links, and dependency manifests. Reject unexpected binaries, remote payload retrieval, obfuscated content, or privilege-sensitive commands. 7. Disable or ignore package lifecycle scripts during acquisition where supported, and execute reviewed components in a sandbox with restricted filesystem, network, credential, and environment-variable access. 8. Document a removal and incident-response procedure for installed skills, including recording provenance and exact versions so compromised components can be identified and revoked. ]]>