T08 · Insecure Dependencies
Error
- Location
- SKILL.md:20
- Finding
- Unpinned npm Package Execution and Shell Injection Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:20-24`, `SKILL.md:29-32`, and `SKILL.md:53` **Vulnerability Type**: Unpinned dependency execution and unsafe shell command construction **Risk Level**: High ### Vulnerable Code ```bash # Run both in parallel, capture output clawhub search "<query>" & CLAWHUB_PID=$! npx skills find <query> 2>&1 & SKILLS_PID=$! wait $CLAWHUB_PID $SKILLS_PID ``` ```bash echo "=== ClawHub ===" && clawhub search "<query>" echo "=== skills.sh ===" && npx skills find <query> 2>&1 ``` The installation example also executes the same unpinned package: ```text Install: npx skills add vercel-labs/agent-skills@react-best-practices -g -y ``` ### Technical Analysis The documented workflow executes `npx skills` without specifying an audited package version or integrity value. Depending on the local npm environment, `npx` can download and execute the package currently published under the `skills` name. The effective executable can therefore change after this skill has been reviewed. This creates a supply-chain trust boundary in which compromise of the npm package, its maintainer account, or its transitive dependencies can result in arbitrary code being run with the agent process's operating-system privileges. In addition, the parallel-search example places `<query>` directly into a shell command without quoting it. If an implementation performs literal textual substitution, shell metacharacters contained in an attacker-controlled query can terminate or extend the intended command. Although the sequential example quotes the ClawHub query, its `npx skills find <query>` invocation remains unquoted. For example, a malicious query containing command separators or command substitution syntax could be interpreted by the shell rather than passed exclusively as a search argument. The exact exploitability depends on how the agent constructs and invokes the documented command, but the instructions explicitly encourage shell execution ...[truncated 1364 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the npm package to a specifically reviewed version rather than invoking the moving package name: ```bash npx --yes skills@<audited-version> find "$query" ``` 2. Commit and enforce a lockfile containing package integrity hashes. Prefer installation through a controlled build process over downloading packages during each skill invocation. 3. Verify the package publisher, provenance, signatures, and dependency tree before approving upgrades. 4. Avoid constructing commands through shell interpolation. Invoke executables with an argument array so the query is passed as one data argument. 5. If shell execution is unavoidable, assign the input to a variable and quote every expansion: ```bash query='<validated query>' clawhub search "$query" npx --yes skills@<audited-version> find "$query" ``` 6. Validate search queries against an appropriate length and character policy. Do not rely on validation alone as a substitute for argument-safe process invocation. 7. Run registry searches in a sandbox with minimal filesystem permissions, no unnecessary secrets in the environment, restricted network access, and no administrative privileges. 8. Remove or revise the global unattended installation example using `-g -y`; require explicit user confirmation and install into a quarantined local location first. ]]>