T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:24
- Finding
- Unpinned Third-Party CLI Execution and Unreviewed Global Skill Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 24–28 and 73–80 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```markdown **Key commands:** - `npx skills find [query]` - Search for skills interactively or by keyword - `npx skills add <package>` - Install a skill from GitHub or other sources - `npx skills check` - Check for skill updates - `npx skills update` - Update all installed skills ``` ```markdown ### Step 4: Offer to Install If the user wants to proceed, you can install the skill for them: ```bash npx skills add <owner/repo@skill> -g -y ``` The `-g` flag installs globally (user-level) and `-y` skips confirmation prompts. ``` ### Technical Analysis The skill instructs the agent to invoke `npx skills` without pinning the CLI to an audited version or integrity hash. Depending on the local npm environment, `npx` can retrieve and execute the named package from an external registry. The effective CLI implementation can therefore differ from the implementation reviewed when this skill was published. The CLI is subsequently used to locate and install skills from third-party repositories. The recommended installation command combines two security-sensitive options: - `-g` installs the selected skill globally at the user level, expanding its effects beyond the current project. - `-y` suppresses confirmation prompts, reducing the opportunity for the user to verify the source and resolved package before installation. The instructions do require the user to want to proceed, so this is not evidence of covert or automatically triggered installation. Nevertheless, the workflow does not require source inspection, immutable commit pinning, integrity validation, publisher verification, or sandboxing before third-party content is executed or installed. ### Attack Path 1. An attacker publishes, compromises, or takes control of the `skills` npm package, a package resolved through it, or a ...[truncated 1710 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the CLI to an exact, audited version instead of invoking an unversioned package: ```bash npx --yes skills@<audited-exact-version> find <query> ``` Record and verify the package integrity hash through a lockfile or an equivalent trusted mechanism. 2. Do not recommend global, non-interactive installation by default. Replace: ```bash npx skills add <owner/repo@skill> -g -y ``` with a project-local, interactive installation command that preserves user confirmation. 3. Require explicit approval immediately before any retrieval or installation. Display the exact publisher, repository URL, resolved version, and commit hash to the user. 4. Pin third-party skills to immutable commit hashes or signed releases. Do not install directly from a mutable branch, tag, or unverified search result. 5. Inspect downloaded skill contents before activation, including instruction files, scripts, package manifests, lifecycle hooks, symbolic links, and referenced external resources. 6. Restrict acceptable sources to a maintained allowlist of trusted publishers and repositories. Verify repository ownership and release signatures where available. 7. Perform retrieval and installation in a sandbox with minimal filesystem, credential, environment-variable, and network access. 8. Separate discovery from installation. Searching for a skill must not automatically authorize downloading, executing, or globally registering it. 9. Document rollback procedures and provide a command that removes the installed skill and any user-level configuration it created. ]]>