T08 · Insecure Dependencies
Warning
- Location
- README-en.md:212
- Finding
- Unpinned Third-Party Installer Executes Mutable Supply-Chain Content## Vulnerability Details **File Location**: `README-en.md`, lines 212–221 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Complete Code Snippet ```markdown ## Install Via [skills.sh](https://skills.sh) (works for Claude Code / Cursor / Codex / CodeBuddy / OpenCode / 50+ agents): ```bash # global (available in all projects) npx skills add dimayip/how-to-harness -g -a claude-code # project-only (committed with your repo) npx skills add dimayip/how-to-harness -a codebuddy ``` ``` The same commands are duplicated in the Chinese documentation at `README.md`, lines 212–221. ### Technical Analysis The documented installation procedure invokes `npx skills` without pinning an exact npm package version. `npx` may resolve and execute the package version currently available from the configured npm registry. The command also identifies the Skill through the mutable GitHub repository name `dimayip/how-to-harness`, rather than an immutable commit and verified digest. Consequently, the code and content executed or installed at installation time are not necessarily the same artifacts reviewed during this audit. The security boundary therefore depends on the npm package, package publisher account, registry resolution, GitHub account, and repository state remaining trustworthy. The `-g` example increases scope by installing the Skill globally for the selected agent platform. Global installation is not necessary for project-specific use and can expose future projects and sessions to subsequently installed instructions. The badge URLs at lines 9–11 are not executable downloads. They are ordinary GitHub links containing externally hosted Shields.io images and are not the source of this finding. ### Attack Path 1. A user copies one of the documented `npx skills add` commands. 2. `npx` resolves the unpinned `skills` package through the user's configured npm registry. 3. The resolved package executes with the operating-system privileges of t ...[truncated 1365 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the installer to a reviewed, exact version, for example by using an explicit `skills@<exact-version>` reference. 2. Pin the Skill source to an immutable Git commit or signed release instead of relying only on a mutable repository name. 3. Publish and verify cryptographic hashes for release artifacts before installation. 4. Prefer project-local installation by default. Present global installation only as an explicit opt-in with a warning that it affects other projects and future sessions. 5. Document a manual installation path from a verified release archive so users can inspect the content before placing it in an agent's Skill directory. 6. Use signed releases or provenance attestations where supported, and document how users can verify them. 7. Add explicit trust-boundary documentation explaining that `npx` executes third-party package code with the invoking user's privileges. 8. Avoid elevated execution and advise users not to run the command with `sudo` or an administrator account.