T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:11
- Finding
- Unpinned Third-Party Installation Commands Permit Supply-Chain Compromise## Vulnerability Details **File Location**: `SKILL.md`, lines 11-22 **Vulnerability Type**: Mutable and unverified third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```bash # Install all skills from repo npx skills add https://github.com/barneyjm/camino-skills # Or install specific skills npx skills add https://github.com/barneyjm/camino-skills --skill camino-query ``` **Via clawhub:** ```bash npx clawhub@latest install camino-query # or: pnpm dlx clawhub@latest install camino-query # or: bunx clawhub@latest install camino-query ``` ### Technical Analysis The documented installation commands download and execute third-party content without pinning it to a reviewed package version, immutable Git commit, or integrity hash. The GitHub commands track mutable repository content, while the `@latest` package selector explicitly resolves to whichever release is current at installation time. Consequently, the code executed by these commands can differ from the code that was originally reviewed. Exploitation requires compromise or malicious control of an upstream package, publisher account, repository, release process, or another relevant software-distribution component. ### Attack Path 1. An attacker compromises an upstream package, publisher account, repository, or release pipeline referenced by the installation instructions. 2. The attacker publishes or commits a malicious version while retaining the expected package or repository identity. 3. A user follows one of the documented commands. 4. `npx`, `pnpm dlx`, `bunx`, or the skill installer resolves and downloads the mutable upstream version. 5. Malicious installation logic or skill content executes with the permissions of the user running the command. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the installing user's account. Depending on that user's privileges and environment, an attacker ...[truncated 363 chars]
- Remediation
- ## Remediation Suggestions - Replace `@latest` with an explicitly reviewed, exact package version. - Pin Git-based installations to a full immutable commit SHA rather than a mutable branch or repository head. - Publish and verify cryptographic checksums or signatures for released packages and skill artifacts. - Use package-manager lockfiles where applicable and enforce integrity metadata during installation. - Review installation lifecycle scripts and downloaded skill contents before execution. - Run installation with a non-privileged account in an isolated environment and avoid invoking these commands with elevated privileges. - Establish a controlled update process that reviews and tests each new dependency version before changing the pinned reference.