T08 · Insecure Dependencies
Warning
- Location
SKILL.md:29- Finding
Unpinned Third-Party CLI and Unattended Global Skill Installation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:29-32andSKILL.md:100-106
Vulnerability Type: Supply-chain exposure through unpinned dependencies and unsafe installation guidance
Risk Level: MediumRelevant code (
SKILL.md:29-32):bash npx skills find [query] npx skills add <package> npx skills check npx skills updateRelevant code (
SKILL.md:100-106):markdown ### Step 6: Offer to Install If the user wants to proceed, you can install the skill for them: ```bash npx skills add <owner/repo@skill> -g -ytext ### Technical Analysis The skill instructs the agent to execute `npx skills` without pinning the npm package to a reviewed version. Unless an appropriate trusted local package is already available, `npx` can resolve and execute package content obtained from the npm ecosystem. The effective CLI implementation may therefore change after this skill has been reviewed. The CLI is then used to retrieve skills from GitHub or other third-party sources. The documented quality checks rely on installation counts, publisher reputation, and GitHub stars. These are useful reputation signals, but they do not establish artifact integrity, inspect installed content, pin an immutable commit, or prevent a compromised publisher account or repository from distributing malicious content. The installation command further uses `-g`, which installs at user scope, and `-y`, which suppresses confirmation prompts. This expands the persistence and exposure of an untrusted skill while reducing the opportunity for the user to review the selected source and installation operation. The project contains no bundled executable script; the risk arises from the documented execution and installation workflow. ### Attack Path 1. An attacker publishes or compromises a package, repository, or skill that appears relevant to a common search query. 2. The agent follows `SKILL.md` and execute ...[truncated 1601 chars]- Remediation
View remediation
Remediation Suggestions
- Pin the CLI to an explicitly reviewed version rather than executing an unqualified package name, for example by using an approved exact version and lockfile-backed installation process.
- Verify package provenance and integrity using registry signatures, checksums, or equivalent controls supported by the distribution mechanism.
- Maintain an allowlist of approved skill publishers, repositories, and immutable commit identifiers.
- Fetch and inspect every skill's complete contents before installation, including instruction files, scripts, hooks, dependencies, and generated configuration.
- Do not treat install counts, repository stars, or publisher names as sufficient security verification.
- Remove
-yso that the exact source, version, destination, and requested changes can be reviewed and explicitly approved. - Avoid
-gby default. Install into an isolated project directory or sandbox with minimal filesystem, network, credential, and tool access. - Require separate user authorization immediately before installation rather than treating a general request to find a skill as installation approval.
- Record the resolved package version, repository commit, integrity value, and installed files to support auditing and reproducibility.
- Scan and test downloaded skills in an isolated environment before allowing them to influence an agent with access to sensitive data or tools.