T08 · Insecure Dependencies
- Location
SKILL.md:29- Finding
Unpinned Third-Party Execution and Unattended Global Skill Installation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 29–33, 128–138, and 247–249
Vulnerability Type: Supply-chain exposure through unpinned packages and globally installed third-party skills
Risk Level: HighVulnerable Code
SKILL.md, lines 29–33:markdown - `npx skills find [query]` — Search for skills by keyword - `npx skills add <package>` — Install a skill from GitHub or other sources - `npx skills add <package> -g -y` — Install globally, skip confirmation - `npx skills check` — Check for skill updates - `npx skills update` — Update all installed skillsSKILL.md, lines 128–138:markdown 2. Run all exact-match searches in parallel first: ```bash npx skills find "<exact-match-keywords>"- Check result counts. For any subtask with < 3 candidates from exact-match, run the functional-match search. If still < 3, run domain-match.
text `SKILL.md`, lines 247–249: ```bash npx skills add owner/repo@skill-a -g -y npx skills add owner/repo@skill-b -g -y npx skills add owner/repo@skill-c -g -yTechnical Analysis
The Skill directs the agent to execute
npx skillswithout pinning the CLI to an immutable, reviewed version. Depending on the local environment and npm cache,npxcan retrieve and execute the current package version from an external registry. Consequently, the code executed during discovery can differ from the code that existed when this Skill was audited.The Skill also generates installation commands for dynamically discovered repositories and recommends the
-g -yoptions. Global installation expands the affected environment beyond the current project, while-ysuppresses package-specific confirmation. Candidate validation is based primarily on descriptions and relevance ratings; the workflow does not require source inspection, publisher verification, commit pinning, integrity validation, or review of package lifecy ...[truncated 2342 chars]- Remediation
View remediation
Remediation Suggestions
-
Pin the Skills CLI
- Invoke an explicitly reviewed version, such as
npx skills@X.Y.Z, rather than allowing npm to resolve the latest release. - Prefer an integrity-locked local development dependency over runtime retrieval through
npx. - Record and verify package hashes or lockfile integrity metadata.
- Invoke an explicitly reviewed version, such as
-
Pin installed skills to immutable revisions
- Resolve each selected repository to a reviewed commit hash.
- Do not install from mutable branches, floating tags, or unversioned search-result identifiers.
- Display the repository URL and exact commit to the user before installation.
-
Require security review before installation
- Verify repository ownership, publisher identity, maintenance history, and provenance.
- Inspect the skill manifest, scripts, dependency tree, and package lifecycle hooks.
- Scan downloaded content for credential access, shell execution, persistence, obfuscation, and unexpected network activity.
-
Avoid unattended global installation
- Remove
-g -yfrom generated commands. - Install into a project-local, isolated directory by default.
- Require explicit approval for each exact package, source, version, and requested installation scope.
- Remove
-
Use isolation and least privilege
- Perform discovery and installation in a sandbox or disposable container.
- Deny access to host credentials, sensitive directories, and unnecessary network destinations.
- Run package installation as an unprivileged account and prohibit privilege elevation.
-
Separate discovery from execution
- Treat search results and third-party descriptions as untrusted metadata.
- Download candidates without executing them, complete static review, and only then permit installation.
- Present provenance and security-review results alongside relevance ratings.
-
Control updates
- Do not run broad update comma ...[truncated 163 chars]
-