T08 · Insecure Dependencies
Warning
- Location
SKILL.md:92- Finding
Unpinned Third-Party Package Execution and Unattended Global Skill Installation
- Content
View full analysis
` - Install a skill from GitHub or other sources - `npx skills check` - Check for skill updates - `npx skills update` - Update all installed skills ``` Lines 92–98: ```markdown ### Step 6: Offer to Install If the user wants to proceed, you can install the skill for them: ```bash npx skills add -g -y ``` ``` ### Technical Analysis The instructions invoke `npx skills` without pinning the npm package to an exact, reviewed version or verifying package integrity. Consequently, the executable package resolved by npm can change after this skill has been audited. The installation target may also originate from search results, user input, GitHub, or other third-party sources. Although the document recommends checking install counts, repository stars, and source reputation, these signals do not establish code integrity and do not protect against repository compromise, publisher-account compromise, typosquatting, malicious updates, or deceptive popularity metrics. The recommended installation command adds two security-sensitive options: - `-g` installs the selected skill globally at the user level, increasing its reach across projects and later agent sessions. - `-y` suppresses confirmation prompts, reducing the opportunity for a user to inspect and reject an unsafe installation. Depending on the behavior of the npm package and selected skill installer, package lifecycle behavior or other installation logic may execute with the permissions of the account running the agent. The repository does not itself contain a malicious payload, but its workflow creates an unsafe third-party supply-chain execution path. ### Attac ...[truncated 1756 chars]- Remediation
View remediation
skills add ``` Enforce the expected package integrity through a lockfile, trusted internal registry, or equivalent checksum-verification mechanism. 2. Restrict installation sources to an explicit allowlist of reviewed repositories and publishers. Do not treat stars, install counts, or recognizable organization names as substitutes for source review. 3. Pin each selected skill to an immutable commit SHA or signed release rather than a mutable branch, tag, or unversioned repository reference. 4. Download the candidate into an isolated staging directory and inspect its instructions, scripts, manifests, lifecycle hooks, dependencies, and network behavior before installation. 5. Remove `-y` from the recommended command. Present the exact source, revision, requested installation scope, and review results, then require explicit user confirmation. 6. Avoid `-g` by default. Prefer project-local or isolated installation with the minimum filesystem and session scope necessary for the requested task. 7. Disable dependency lifecycle scripts where supported, or perform installation in a sandbox with restricted network access, filesystem access, environment variables, credentials, and operating-system permissions. 8. Verify release signatures or checksums and record the approved source and immutable revision for future audits and updates. 9. Apply the same controls to `npx skills check` and `npx skills update`; updates must not automatically replace reviewed content with an unreviewed remote version. ]]>