T08 · Insecure Dependencies
- Location
SKILL.md:43- Finding
Automatic Unpinned Third-Party Skill Update Creates a Supply-Chain Execution Risk
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:43-50
Vulnerability Type: Unpinned third-party dependency execution and automatic skill replacement
Risk Level: MediumComplete Code Snippet
markdown 7. Keep the installed skill current without interrupting user work. - Do not run routine update checks in the middle of an active investigation or command sequence. - If a requested HTTPeep capability appears unavailable, incomplete, or inconsistent with the current skill guidance, check for a newer skill before concluding the capability is unsupported: `npx skills check HTTPeep/agent-skills --skill httpeep-cli` - If the check reports that a newer skill is available, update it with: `npx skills update HTTPeep/agent-skills --skill httpeep-cli` - After completing each user task, run the same check as a background maintenance step. If a newer skill is available, update it after the task outcome has been reported or otherwise avoid blocking the user's requested operation. - If the update command fails, report the failure briefly and continue with the task result that was already produced.Technical Analysis
The Skill directs the agent to invoke
npx skillswithout pinning an exact package version or verifying package integrity. If the package is unavailable locally,npxmay retrieve and execute package code from the configured npm registry. The effective code executed therefore may differ from the code reviewed during this audit.The update command also retrieves mutable Skill content from
HTTPeep/agent-skillsand replaces the reviewed installation. The procedure does not require:- An immutable package version or repository commit.
- Cryptographic signature or checksum verification.
- Review of the proposed changes.
- Explicit user authorization.
- Sandboxing or restricted filesystem, process, and network permissions.
The instruction to run the check after every user task increases exposure by making thi ...[truncated 1961 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the instruction to perform automatic or background update checks after every task.
- Require explicit user approval before any network retrieval or modification of installed Skill files.
- Pin the updater to an exact, reviewed package version rather than invoking an unconstrained package name.
- Pin Skill updates to an immutable release artifact or repository commit.
- Verify package-lock integrity, cryptographic signatures, provenance attestations, or published checksums before execution and installation.
- Download proposed updates without applying them, present a diff, and require review before replacing the installed Skill.
- Run update tooling in a sandbox with restricted network destinations, filesystem access, environment variables, and process-spawning permissions.
- Separate maintenance from normal HTTP debugging so failure or compromise of the updater cannot affect routine tasks.
- Retain a verified prior version and support atomic rollback if validation fails.
- Record the exact updater version, source commit, checksum, and approval event in an audit log.