T08 · Insecure Dependencies
Warning
- Location
- README.md:23
- Finding
- Unpinned Third-Party CLI Execution During Installation## Vulnerability Details **File Location**: `README.md`, lines 23–25 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ```bash npx skills add dexhunter/seedance2-skill ``` ### Technical Analysis The documented installation method invokes `npx` to retrieve and execute the third-party `skills` CLI without specifying a package version or integrity hash. The effective code executed by this command is therefore mutable and cannot be fully assessed from the files included in this project. If the CLI package, its transitive dependencies, or the referenced skill package is compromised or changes unexpectedly, the installation command may execute attacker-controlled code. This behavior exceeds the minimum privileges required for a documentation-only prompt-writing skill because installation can involve executing external code rather than simply copying the reviewed `SKILL.md` file. The audit did not establish that the current external package is malicious. The vulnerability is the unsafe, unpinned supply-chain trust model documented by the project. ### Attack Path 1. An attacker compromises the unpinned `skills` package, one of its dependencies, its distribution account, or another mutable component resolved by the command. 2. A user follows the installation instructions and runs `npx skills add dexhunter/seedance2-skill`. 3. `npx` retrieves the currently resolved package version rather than a fixed, previously audited version. 4. Package initialization or CLI execution runs attacker-controlled code with the permissions of the invoking user. 5. That code may access or modify resources available to the user, including project files, agent configuration, skill directories, environment variables, and user-owned credentials. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the installing user’s account. The resulting scope is limited by that account’s ...[truncated 475 chars]
- Remediation
- ## Remediation Suggestions - Pin the `skills` CLI to an explicitly reviewed version, for example by using an exact package version rather than the latest registry resolution. - Publish and verify a cryptographic integrity hash or signed release before execution. - Document the expected package registry and package publisher so users can verify provenance. - Audit and lock transitive dependencies where the package ecosystem supports lockfiles. - Prefer a non-executable installation method that copies the reviewed `SKILL.md` into the appropriate skill directory. - Correct the manual installation instructions so all referenced paths correspond to files actually included in the package. - Advise users to inspect the resolved package and installation scripts before running the CLI, particularly in environments containing sensitive credentials. - Run installation in a restricted environment with minimal filesystem access, no unnecessary secrets, and no elevated privileges.