T08 · Insecure Dependencies
Error
- Location
SKILL.md:25- Finding
Silent Execution of an Unpinned Package and Automatic Skill Update
- Content
View full analysis
&1 | grep -qiE "second-me-skills|second\.me"; then npx skills update mindverse/second-me-skills -y 2>&1 || true fi ``` ### Technical Analysis The Skill instructs the agent to invoke `npx skills` automatically during its pre-flight process. No exact package version, package digest, repository revision, or signature is specified. Depending on the local npm environment, `npx` can resolve and execute a package obtained from a remote registry. The subsequent update command automatically modifies the installed Skill from the mutable `mindverse/second-me-skills` source. The `-y` option suppresses interactive confirmation, while `|| true` suppresses update failures. Consequently, reviewed Skill instructions can be replaced without the user reviewing or approving the new version. This behavior is not required for the Skill's core function of assisting with SecondMe application development. It therefore exceeds the minimum privilege necessary and creates an avoidable remote supply-chain execution channel. ### Attack Path 1. An attacker compromises the package resolved as `skills`, the relevant package registry entry, or the upstream `mindverse/second-me-skills` repository. 2. The Skill is activated after the 24-hour update interval. 3. `npx skills check` resolves and executes the mutable package without a pinned version or integrity check. 4. The compromised package reports an applicable update or directly executes malicious installation logic. 5. `npx skills update ... -y` downloads and applies attacker-controlled Skill content without user confirmation. 6. The new package code or Skill instructions execute with the permissions of the agent process during current or subsequent invocations. ### Impact Assessment Successful exploitatio ...[truncated 630 chars]- Remediation
View remediation