T08 · Insecure Dependencies
Error
- Location
- SKILL.md:29
- Finding
- Unpinned Third-Party Execution and Unattended Global Skill Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 29–33, 128–138, and 247–249 **Vulnerability Type**: Supply-chain exposure through unpinned packages and globally installed third-party skills **Risk Level**: High ### Vulnerable Code `SKILL.md`, lines 29–33: ```markdown - `npx skills find [query]` — Search for skills by keyword - `npx skills add <package>` — Install a skill from GitHub or other sources - `npx skills add <package> -g -y` — Install globally, skip confirmation - `npx skills check` — Check for skill updates - `npx skills update` — Update all installed skills ``` `SKILL.md`, lines 128–138: ```markdown 2. Run all exact-match searches in parallel first: ```bash npx skills find "<exact-match-keywords>" ``` 3. Check result counts. For any subtask with < 3 candidates from exact-match, run the functional-match search. If still < 3, run domain-match. ``` `SKILL.md`, lines 247–249: ```bash npx skills add owner/repo@skill-a -g -y npx skills add owner/repo@skill-b -g -y npx skills add owner/repo@skill-c -g -y ``` ### Technical Analysis The Skill directs the agent to execute `npx skills` without pinning the CLI to an immutable, reviewed version. Depending on the local environment and npm cache, `npx` can retrieve and execute the current package version from an external registry. Consequently, the code executed during discovery can differ from the code that existed when this Skill was audited. The Skill also generates installation commands for dynamically discovered repositories and recommends the `-g -y` options. Global installation expands the affected environment beyond the current project, while `-y` suppresses package-specific confirmation. Candidate validation is based primarily on descriptions and relevance ratings; the workflow does not require source inspection, publisher verification, commit pinning, integrity validation, or review of package lifecy ...[truncated 2342 chars]
- Remediation
- ## Remediation Suggestions 1. **Pin the Skills CLI** - Invoke an explicitly reviewed version, such as `npx skills@X.Y.Z`, rather than allowing npm to resolve the latest release. - Prefer an integrity-locked local development dependency over runtime retrieval through `npx`. - Record and verify package hashes or lockfile integrity metadata. 2. **Pin installed skills to immutable revisions** - Resolve each selected repository to a reviewed commit hash. - Do not install from mutable branches, floating tags, or unversioned search-result identifiers. - Display the repository URL and exact commit to the user before installation. 3. **Require security review before installation** - Verify repository ownership, publisher identity, maintenance history, and provenance. - Inspect the skill manifest, scripts, dependency tree, and package lifecycle hooks. - Scan downloaded content for credential access, shell execution, persistence, obfuscation, and unexpected network activity. 4. **Avoid unattended global installation** - Remove `-g -y` from generated commands. - Install into a project-local, isolated directory by default. - Require explicit approval for each exact package, source, version, and requested installation scope. 5. **Use isolation and least privilege** - Perform discovery and installation in a sandbox or disposable container. - Deny access to host credentials, sensitive directories, and unnecessary network destinations. - Run package installation as an unprivileged account and prohibit privilege elevation. 6. **Separate discovery from execution** - Treat search results and third-party descriptions as untrusted metadata. - Download candidates without executing them, complete static review, and only then permit installation. - Present provenance and security-review results alongside relevance ratings. 7. **Control updates** - Do not run broad update comma ...[truncated 163 chars]