T08 · Insecure Dependencies
- Location
SKILL.md:293- Finding
Unpinned CLI Execution and Unreviewed Third-Party Skill Installation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:293-299
Vulnerability Type: Supply-chain risk from an unpinned npm CLI and third-party skill installation
Risk Level: MediumVulnerable Code
bash # Find skills in your category npx molthub@latest search "your topic" # For each competing skill: # 1. Install it npx molthub@latest install competitor-skillThe same unpinned
npx molthub@latestpattern is also used for search and publishing operations atSKILL.md:56,SKILL.md:229-244, andSKILL.md:270-286.Technical Analysis
The documented workflow uses
npxto retrieve and execute the package version currently associated with the mutablelatestdistribution tag. No fixed version, package integrity value, lockfile, or provenance-verification procedure is specified. Consequently, the code executed by users can change after this skill has been reviewed.The competitor-analysis procedure compounds this risk by directing users to install an unspecified third-party skill. The instructions do not require source inspection, publisher verification, signature validation, or sandboxing before installation.
This is an insecure dependency and supply-chain practice rather than evidence that the current package itself contains a malicious payload. Exploitation would depend on compromise or malicious control of the npm package, one of its dependencies, the relevant registry account, or the selected competitor skill.
Attack Path
- An attacker compromises the
molthubpackage, its publisher account, or a transitive dependency, and causes a malicious release to receive thelatesttag; alternatively, the attacker publishes a malicious competitor skill. - A user follows the documented command using
npx molthub@latest. npxretrieves and runs the package version selected at execution time rather than a previously reviewed, pinned version.- The compromised CLI runs with the privileges ...[truncated 955 chars]
- An attacker compromises the
- Remediation
View remediation
Remediation Suggestions
- Replace
npx molthub@latestwith an explicitly pinned and reviewed version, for examplenpx molthub@X.Y.Z, after verifying the official package identity. - Prefer a project-local dependency managed through a lockfile so the exact package and transitive dependency versions are reproducible.
- Verify npm package provenance, publisher identity, signatures or attestations where available, and registry integrity metadata before execution.
- Review release notes and source changes before updating the pinned CLI version.
- Require source inspection of competitor skills before installation, including their scripts, lifecycle hooks, dependencies, and requested capabilities.
- Install and evaluate untrusted skills in an isolated container or sandbox with minimal filesystem access, no sensitive environment variables, restricted network access, and a non-privileged user.
- Disable dependency lifecycle scripts during inspection where feasible and only enable them after review.
- Add an explicit warning that publishing transmits selected local skill content to an external registry and require users to check it for secrets before upload.
- Replace