T08 · Insecure Dependencies
Warning
- Location
- skillhub.json:14
- Finding
- Unpinned Global Package and Mutable Source Installation<![CDATA[ ## Vulnerability Details **File Location**: `skillhub.json:14-23`; additional occurrences in `SKILL.md:29-46` and `README.md:13-35` **Vulnerability Type**: Unpinned third-party dependencies and execution of a mutable remote installation script **Risk Level**: Medium ### Vulnerable Code `skillhub.json:14-23`: ```json "package": { "name": "aide-skill-manager", "manager": "npm", "install": "npm i -g aide-skill-manager" }, "setup": [ "npm i -g aide-skill-manager", "skm setup", "skm scan" ], ``` `SKILL.md:29-46`: ```markdown ## 安装与更新 推荐安装： ```bash npm i -g aide-skill-manager skm setup skm scan ``` 源码安装： ```bash git clone https://github.com/GrubbyLee/skill-manager.git cd skill-manager node scripts/install.mjs skm scan ``` ``` `README.md:13-35`: ```markdown ## Install ```bash npm i -g aide-skill-manager skm setup skm scan ``` `skm setup` installs this bridge skill into: ```text ~/.claude/skills/skill-navigator ~/.codex/skills/skill-navigator ``` For source installs: ```bash git clone https://github.com/GrubbyLee/skill-manager.git cd skill-manager node scripts/install.mjs skm scan ``` ``` ### Technical Analysis The documented npm installation does not pin `aide-skill-manager` to an exact reviewed version. Consequently, the code installed depends on whichever package version the registry resolves at installation time. Global npm installation may execute package lifecycle scripts and places package executables in a globally accessible location. The source-based alternative clones the repository's mutable default branch and immediately executes `node scripts/install.mjs`. It does not pin the checkout to a reviewed commit, verify a cryptographic checksum, or validate a signed release before execution. The effective installation payload can therefore change after this Skill artifact has been audited. No implementation of `aide-skill-manager`, `skm`, or `scripts/install.mjs` is included in the audited artifact. Their runtime behavior ...[truncated 1813 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the npm dependency to an exact reviewed version: ```bash npm i -g aide-skill-manager@<reviewed-version> ``` 2. Publish and document the expected npm integrity digest, provenance information, and release signature. Verify these values before installation. 3. Pin source installations to a reviewed commit rather than executing the mutable default branch: ```bash git clone https://github.com/GrubbyLee/skill-manager.git cd skill-manager git checkout <reviewed-full-commit-hash> ``` 4. Verify the checked-out commit or release using a trusted signature and compare the installation script against a published checksum before executing it. 5. Avoid global installation where feasible. Prefer a project-local installation or an isolated environment with only the filesystem and network permissions required for catalog recommendation. 6. Include the relevant installer and CLI implementation in the auditable distribution, or provide reproducible-build and provenance records that allow reviewers to verify the code represented by the package. 7. Document all npm lifecycle scripts and filesystem changes performed by `scripts/install.mjs`, `skm setup`, and `skm scan`. 8. Require explicit user confirmation before writing to `~/.claude/skills`, `~/.codex/skills`, or other Agent configuration locations, and create verified backups before modifying existing content. ]]>