T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:16
- Finding
- Unpinned Third-Party Package Execution and Remote Skill Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 16–34 **Vulnerability Type**: Unpinned and mutable third-party dependencies **Risk Level**: Medium ```bash # Spaces and worldbuilding npx skills add talesofai/neta-skills/skills/neta-space # Creative content (images/videos/songs/MVs) npx skills add talesofai/neta-skills/skills/neta-creative # Community browsing and interactions npx skills add talesofai/neta-skills/skills/neta-community # Research and content suggestions npx skills add talesofai/neta-skills/skills/neta-suggest # Character creation and management npx skills add talesofai/neta-skills/skills/neta-character # Elementum (visual style/concept) creation and management npx skills add talesofai/neta-skills/skills/neta-elementum ``` ### Technical Analysis The documented commands invoke `npx skills` without pinning the npm package to a reviewed version. Depending on local npm behavior and package availability, `npx` may retrieve and execute package code from the npm registry. The commands also install skill content from the mutable `talesofai/neta-skills` repository without specifying an immutable commit, release, or integrity hash. Consequently, the effective installer and installed skill content can change after this project has been reviewed. A compromise of the npm package, its maintainer account, the remote repository, or an upstream dependency could introduce attacker-controlled code or skill instructions. Remote installation is relevant when a user explicitly requests a sub-skill, but it is not necessary for this skill's primary overview and routing function. Recommending immediate execution of third-party installers therefore exceeds the minimum privileges required merely to classify a task or explain the capability map. The static pre-scan warning concerning sensitive network transmission was also reviewed. `SKILL.md` does not read credentials, environment variables, private keys, or local files, and it does not explicitly in ...[truncated 1717 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the npm package to an explicitly reviewed version, for example by using a version-qualified package reference supported by the installation environment. 2. Pin each remote skill to an immutable commit hash or signed release rather than a mutable repository path. 3. Publish and verify cryptographic checksums or signatures for the installer and installed skill contents. 4. Require explicit user confirmation before downloading or executing third-party content, and display the source, version, and requested destination. 5. Separate routing guidance from installation. The overview skill should select and describe the appropriate sub-skill without automatically requiring package execution. 6. Recommend reviewing the selected sub-skill and its scripts before installation or invocation. 7. Run installation in a sandbox or least-privileged environment with restricted filesystem, credential, and network access. 8. Document the trusted npm scope, repository owner, expected package identity, and a procedure for responding to upstream compromise.