T08 · Insecure Dependencies
Warning
- Location
SKILL.md:23- Finding
Unpinned CLI Execution and Unverified Global Skill Installation
- Content
View full analysis
` - Install a skill from GitHub or other sources - `npx skills check` - Check for skill updates - `npx skills update` - Update all installed skills ``` ```markdown ### Step 2: Search for Skills Run the find command with a relevant query: ```bash npx skills find [query] ``` ``` ```markdown ### Step 4: Offer to Install If the user wants to proceed, you can install the skill for them: ```bash npx skills add -g -y ``` The `-g` flag installs globally (user-level) and `-y` skips confirmation prompts. ``` ### Technical Analysis The skill directs the agent to execute `npx skills` without pinning the npm package to an exact reviewed version or verifying its integrity. Depending on the local npm environment, `npx` can download and execute the package resolved from the configured registry. Consequently, the code executed by this command may differ from the code that existed when this skill was audited. The resulting workflow also permits installation from GitHub or unspecified “other sources.” It does not require verification of repository ownership, immutable commit identifiers, signatures, checksums, package contents, or requested capabilities before installation. The recommended installation command uses `-g`, increasing the installation scope to the user environment, and `-y`, suppressing the package manager's confirmation prompt. This creates a supply-chain trust gap. A compromised or impersonated CLI package, malicious search result, compromised upstream repository, or mutable skill release could introduce attacker-controlled instructions or executable components. No e ...[truncated 2026 chars]- Remediation
View remediation
`, and verify the package using a lockfile or expected integrity hash. 2. Configure npm to use a trusted registry and validate the package name, publisher, provenance attestations, and signatures before execution. 3. Maintain an allowlist of approved skill repositories and publishers. Do not install packages from unspecified “other sources.” 4. Resolve skills to immutable commit hashes or signed release artifacts rather than mutable branches or tags. 5. Download each candidate skill into a non-executing staging directory and inspect its instructions, scripts, dependencies, hooks, and metadata before installation. 6. Remove `-y` so that installation requires an explicit confirmation step after the exact source, revision, and requested scope are displayed. 7. Avoid `-g` by default. Prefer project-local installation in an isolated environment with minimum filesystem, network, credential, and command-execution permissions. 8. Require renewed user authorization before installation; consent to searching should not be treated as consent to execute or install a result. 9. Apply updates only after reviewing version changes and integrity information. Do not use an unrestricted bulk-update workflow for security-sensitive skills. 10. Record the approved source, immutable revision, integrity value, reviewer, and installation time to support later auditing and incident response. ]]>