T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:24
- Finding
- Unpinned Third-Party Dependency Execution During Migration## Vulnerability Details **File Location**: `SKILL.md`, lines 24–26 **Vulnerability Type**: Unpinned external package and repository installation **Risk Level**: Medium ```bash npx skills add deusyu/translate-book -a claude-code -g ``` ### Technical Analysis The documented migration command invokes the unversioned `skills` npm package through `npx` and installs Skill content from the external `deusyu/translate-book` GitHub repository. Neither the npm package version nor a Git commit is pinned, and the instructions provide no checksum or signature verification. Consequently, the resources retrieved when a user runs this command may differ from those that existed when this Skill was audited. This creates a supply-chain trust boundary in which compromise, replacement, or malicious updates of the npm package or referenced repository could cause attacker-controlled installer behavior or Skill content to be executed or installed. The `-g` option requests global installation, increasing the installed content's persistence and potential exposure across projects. ### Attack Path 1. An attacker compromises or gains publishing control over the unpinned `skills` npm package, the referenced GitHub repository, or another relevant distribution component. 2. The attacker publishes a malicious package version, installer implementation, or replacement Skill content. 3. A user follows the migration instructions and runs the documented `npx` command. 4. `npx` resolves the current unpinned package, which may differ from the reviewed version. 5. The installer retrieves and globally installs attacker-controlled repository content. 6. Any malicious behavior available to the retrieved installer or subsequently loaded Skill runs with the invoking user's permissions. ### Impact Assessment Successful exploitation could execute installer behavior under the invoking user's account or install malicious Skill instructions that affect later agent sessions. The exact privileges are lim ...[truncated 298 chars]
- Remediation
- ## Remediation Suggestions - Pin the npm package to a reviewed, immutable version rather than invoking an unversioned package through `npx`. - Pin the source repository to a specific reviewed commit instead of a mutable branch or repository head. - Publish and verify cryptographic checksums or signatures for the installer and Skill package. - Use a verified first-party installation channel with provenance attestations where available. - Remove `-g` unless global installation is operationally necessary; prefer project-scoped installation to reduce exposure. - Document the expected package version, source commit, publisher identity, and integrity-verification procedure. - Re-audit the exact pinned installer and replacement Skill before recommending migration.