T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:217
- Finding
- Unpinned Packages Executed Through npx## Vulnerability Details **File Location**: `SKILL.md`, lines 217-226 **Vulnerability Type**: Unpinned executable dependency and mutable Skill update source **Risk Level**: Medium ```bash # Check if updates are available npx skills check # Update all installed skills to latest versions npx skills update ``` ```bash npx skills add openserv-labs/skills ``` ### Technical Analysis The documented commands invoke the unversioned `skills` npm package through `npx`. If the package is not already installed locally, `npx` can resolve, download, and execute the current registry version under the user's account. The instructions do not pin an exact package version, verify a package integrity hash, or identify a reviewed Skill commit. The update and installation commands also retrieve mutable Skill content. Consequently, the code and instructions that ultimately execute can differ from the content reviewed in this audit. This creates a supply-chain trust boundary in which compromise of the package, publisher account, package registry, or upstream Skill repository could introduce attacker-controlled behavior. ### Attack Path 1. An attacker compromises the relevant npm package, publisher credentials, registry resolution path, or upstream Skill source. 2. The attacker publishes or serves a malicious version while preserving the expected package or repository name. 3. A user follows the instructions and runs one of the unversioned `npx skills` commands. 4. `npx` resolves and executes the mutable package under the user's local privileges. 5. The malicious package can access resources available to that user. Alternatively, an update can install malicious Skill instructions that influence later agent operations. ### Impact Assessment A malicious npm payload would execute with the privileges of the user running `npx`. Depending on the execution environment, this could expose accessible files, environment variables, development ...[truncated 379 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the CLI to an exact reviewed version, for example `npx --yes skills@X.Y.Z`, after verifying the correct package identity. 2. Use a lockfile and require npm integrity verification for executable dependencies. 3. Pin Skill installation to an immutable commit hash or signed release rather than a mutable repository head. 4. Document the expected npm scope, publisher, repository, release checksum, and signature-verification procedure. 5. Separate checking from applying updates; display the proposed version and changes, then require explicit review before installation. 6. Run package and Skill installation in a restricted environment without production secrets or elevated privileges. 7. Re-audit updated Skill content before trusting or executing it.